On this page22 sections

Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how Agalta, a commercial name operated by Doowings BV (“Agalta”, “we”, “us”, “our”), collects and processes personal data in connection with our recruitment, staffing and consulting activities and through our website.

We take the protection of personal data seriously and process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and other applicable privacy and electronic communications laws.

1. Who we are

The data controller is:

Doowings BV
Trading as: Agalta
Registered office: Waterloosesteenweg 260, 1640 Sint-Genesius-Rode, Belgium
Company / enterprise number: BE 0634.962.988
VAT number: BE 0634.962.988
Email for privacy requests: privacy@agalta.be
General contact email: contact@agalta.be
Website: https://agalta.be

Unless otherwise stated, we act as the data controller for the processing described in this Policy.

2. Who this Policy applies to

This Policy applies in particular to:

  • candidates and prospective candidates;
  • freelancers, contractors and consultants;
  • individuals who apply for a vacancy through us;
  • people whose professional profile we identify through professional networks, job boards, public sources, referrals or recruitment databases;
  • referees and professional references;
  • client contacts, hiring managers and prospective clients;
  • suppliers, partners and professional advisers;
  • visitors to our website; and
  • other individuals who communicate or interact with us in a professional context.

3. Personal data we collect

The personal data we process depends on the nature of our relationship with you.

3.1 Candidates, freelancers and consultants

We may process information such as:

  • name and professional contact details;
  • CV, résumé and cover-letter information;
  • professional experience, job titles and employment history;
  • education, qualifications, certifications and skills;
  • languages and professional interests;
  • LinkedIn or other professional profile information;
  • availability, desired role, assignment preferences and geographical preferences;
  • remuneration, salary, fee or rate expectations where relevant;
  • work authorisation and information necessary to establish eligibility to work;
  • notes relating to recruitment conversations, interviews and interactions with us;
  • application history and roles or assignments discussed with you;
  • feedback received from clients in connection with a recruitment process;
  • references and reference-check information where appropriate;
  • information you choose to provide in emails, forms, telephone calls or other communications;
  • records of consent, preferences, objections and privacy requests; and
  • other information reasonably necessary to provide recruitment or staffing services.

We do not intentionally request information that is irrelevant to recruitment decisions.

3.2 Client and business contacts

We may process:

  • name;
  • employer or organisation;
  • job title and professional role;
  • professional email address and telephone number;
  • office or business address;
  • correspondence and meeting information;
  • recruitment needs, vacancies and assignment requirements;
  • contract, commercial and invoicing-related information; and
  • records of our business relationship and communications.

3.3 Website visitors

Depending on how you use our website, we may process:

  • IP address;
  • browser and device information;
  • date and time of access;
  • requested pages and technical request information;
  • security and anti-abuse signals;
  • information submitted through website forms; and
  • cookie or similar-technology information as described in our Cookie Policy.

We do not use website information to make recruitment decisions solely on the basis of browsing behaviour.

4. Where we obtain personal data

We may obtain personal data:

Directly from you

For example when you:

  • apply for a role;
  • submit your CV;
  • contact us;
  • speak with one of our recruiters;
  • respond to a recruitment approach;
  • enter into a contract or assignment;
  • provide information during an interview or recruitment process; or
  • exercise a privacy right.

From professional and public sources

As part of our recruitment activity, we may identify candidates or business contacts through sources such as:

  • LinkedIn and other professional networking platforms;
  • job boards and CV databases to which we have lawful access;
  • professional directories;
  • company websites;
  • publicly available professional information;
  • industry events and networking activities.

Where we obtain your personal data indirectly, we will provide the information required by Article 14 GDPR within the applicable period, unless an exception under the GDPR applies.

From third parties

We may also receive information from:

  • clients and prospective clients;
  • recruitment partners;
  • professional references;
  • previous employers, where appropriate and lawful;
  • education or certification providers, where verification is appropriate and lawful;
  • suppliers and service providers; or
  • another person who refers or recommends you to us.

5. Why we process personal data and our lawful bases

We only process personal data when we have a lawful basis to do so.

5.1 Recruitment and candidate sourcing

We process candidate data to:

  • identify potentially relevant candidates for vacancies or assignments;
  • contact candidates about professional opportunities;
  • assess suitability for a role or assignment;
  • match candidates with client requirements;
  • organise interviews and recruitment processes;
  • maintain an appropriate talent network;
  • communicate about current and future opportunities; and
  • administer placements and assignments.

Depending on the circumstances, we rely on:

  • legitimate interests, in particular our legitimate interest as a recruitment business in identifying and communicating with professionals who may reasonably be interested in relevant employment or contracting opportunities;
  • steps taken at your request before entering into a contract, where you apply or ask us to represent you;
  • performance of a contract, where we have a contractual relationship with you; and
  • consent, where consent is required or where we choose consent as the appropriate lawful basis.

When relying on legitimate interests, we consider whether our interests are proportionate and whether your rights and reasonable expectations override those interests.

5.2 Presenting candidates to clients

We use candidate information to introduce suitable candidates to organisations seeking employees, freelancers or consultants.

Agalta will not send your identifiable CV or profile to a prospective client without first informing you of the opportunity and obtaining your agreement to be represented for that opportunity.

Where appropriate, we may discuss anonymised or non-identifying candidate profiles with a client before disclosing your identity.

5.3 Client and business relationships

We process client and business contact data to:

  • provide recruitment, staffing or consulting services;
  • identify potential business opportunities;
  • communicate about vacancies, assignments and candidates;
  • negotiate, enter into and perform contracts;
  • manage accounts, invoicing and payments;
  • maintain business relationships; and
  • establish, exercise or defend legal claims.

The lawful bases may include legitimate interests, contractual necessity and compliance with legal obligations.

5.4 Website operation, security and fraud prevention

We process technical data in order to:

  • operate and secure our website;
  • prevent spam, abuse and automated submissions;
  • diagnose faults;
  • protect our infrastructure; and
  • maintain the integrity and availability of our services.

We rely primarily on our legitimate interests in operating a secure website and preventing abuse.

Our website uses Cloudflare, including Cloudflare Workers and Cloudflare Turnstile. Turnstile processes technical signals such as IP address, user-agent information and browser/network signals to distinguish legitimate users from automated traffic. Turnstile is used for security and anti-abuse purposes rather than advertising.

5.5 Contact forms

When you submit a form through our website, we process the information you provide to respond to your request or candidate introduction. Employer enquiries include your email, role requirements, engagement type, timing and optional notes. Candidate introductions include your email, a description of your work, engagement preference and an optional professional-profile link.

The website forms accept text only, not CVs or file attachments. Do not paste a full CV or unnecessary sensitive information into them. Our Worker checks the submission and its security token before forwarding it through Web3Forms to our enquiry mailbox. You can also contact us directly at contact@agalta.be. The website is not currently an ATS or CV-upload portal; a future ATS will replace this delivery integration.

We rely on legitimate interests in responding to relevant enquiries, or steps taken at your request before entering a contract where that basis applies. Sending an enquiry is not consent to optional website analytics or marketing.

Our website currently uses Web3Forms to process and forward website form submissions. See Section 10 for information concerning service providers and international transfers.

We may process data when necessary to:

  • comply with accounting, tax, employment, social-security or other legal obligations;
  • respond to lawful requests from authorities;
  • prevent or investigate fraud or unlawful activity; and
  • establish, exercise or defend legal claims.

6. Special categories of personal data

We do not seek to collect special categories of personal data—such as information concerning health, racial or ethnic origin, political opinions, religion, trade-union membership, genetic or biometric data, or sexual life/orientation—unless this is genuinely necessary and lawful.

Candidates should generally avoid including unnecessary sensitive information in their CV or application.

If processing of special-category data is necessary, we will only do so where an appropriate condition under Article 9 GDPR applies.

Information relating to criminal convictions or offences will only be processed where permitted by applicable law and genuinely relevant to the role concerned.

7. Recruitment decisions and automated processing

Agalta does not make decisions producing legal or similarly significant effects on candidates solely by automated means.

We use, or may use, AI-assisted and other software tools to support candidate sourcing, summarising CVs or professional profiles, matching, scoring or ranking potentially relevant candidates, and drafting recruitment communications. Depending on the task, these tools may process the full CV or professional profile, including identifying information. We do not claim that all AI input is anonymised.

These tools support our recruiters rather than replace their judgment. Material recruitment decisions, including rejection and whether to present a candidate to a client, remain subject to meaningful human review. Recruiters assess and can override AI outputs; candidate approval is required for each specific identifiable introduction to a client.

Our requirement is that candidate data must not be used by AI providers to train their general models. Providers must support this restriction through appropriate terms and settings. We limit processing to the recruitment task and apply the safeguards described in this Policy. You may exercise applicable objection and other data-protection rights by contacting privacy@agalta.be.

We do not rely on solely automated decision-making within the meaning of Article 22 GDPR for candidate selection.

8. Sharing personal data

We may share personal data where necessary with:

Clients and prospective clients

Candidate information may be provided to clients in connection with specific employment or contracting opportunities, subject to the safeguards described in this Policy.

Service providers and processors

We may use third-party providers for services such as:

  • website hosting and infrastructure;
  • cybersecurity and anti-abuse protection;
  • form handling;
  • email;
  • recruitment or applicant-tracking systems;
  • AI-assisted recruitment and productivity tools;
  • CRM systems;
  • cloud storage;
  • accounting;
  • electronic signatures;
  • IT support; and
  • professional administration.

These providers are only authorised to process personal data as required to provide their services and subject to appropriate contractual and security arrangements where required by law.

Professional advisers and authorities

We may disclose data to:

  • lawyers;
  • accountants and auditors;
  • insurers;
  • courts;
  • regulators;
  • law-enforcement agencies; and
  • public authorities,

where necessary or legally required.

Corporate transactions

Personal data may be disclosed as part of a merger, acquisition, restructuring, investment, financing or sale of all or part of our business, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal data.

9. Our current website service providers

Cloudflare

Our website uses Cloudflare infrastructure and security services, including Cloudflare Workers and Cloudflare Turnstile.

Cloudflare may process technical request data and security signals in connection with website delivery, security, abuse prevention and Turnstile verification.

Web3Forms

Our website currently uses Web3Forms to process and forward form submissions.

According to Web3Forms’ published documentation, form submissions are processed and forwarded rather than retained as stored form submissions by Web3Forms. Web3Forms states that server logs may contain personally identifiable information and that those logs are periodically deleted, approximately every two months.

Web3Forms states that its servers are located in the United States (US-East region).

Because Web3Forms processes data in the United States, Agalta will ensure that an appropriate GDPR Chapter V transfer mechanism and any required data-processing terms are in place before relying on the service for production candidate data.

Additional systems

We may also use recruitment, CRM, email, cloud-storage, AI, scheduling and productivity systems to support our operations. Access to candidate records is limited to authorised staff working on relevant recruitment assignments; clients are not given direct access to the internal ATS by default. We provide further information about relevant recipients and safeguards on request where required by law.

10. International transfers

Some of our service providers may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred to a country that is not recognised by the European Commission as providing an adequate level of protection, we will use an appropriate transfer mechanism where required, such as:

  • the European Commission’s Standard Contractual Clauses;
  • another legally recognised safeguard; and
  • supplementary technical or organisational measures where appropriate.

Where a provider participates in an applicable adequacy framework or is located in a country covered by an adequacy decision, we may rely on that mechanism where legally appropriate.

You may contact us for further information about the safeguards used for relevant international transfers.

11. How long we retain personal data

We do not keep identifiable personal data for longer than necessary for the purposes for which it was collected, taking into account our legal obligations and legitimate business requirements.

Candidates and prospective candidates

We retain candidate records for up to 3 years after our last meaningful recruitment-related interaction with you, then delete them, except for limited records justified by legal obligations, legal claims or honouring opt-outs.

Meaningful interaction includes substantive recruitment exchanges or active participation in a recruitment process. Automated emails, email opens and internal AI processing do not restart this period. This retention rule also applies to candidate information received by email; the future ATS is intended to automate deletion.

Data may be retained for longer where necessary to comply with legal obligations or to establish, exercise or defend legal claims.

Successful placements, contractors and consultants

Where a candidate is placed, employed, contracted or assigned through us, certain information may be retained for longer periods where required for contractual, tax, accounting, employment, social-security, audit or legal purposes.

Client and business contacts

We retain active business relationship information while the relationship remains relevant. Certain records may be retained for longer where necessary to comply with contractual, accounting, tax or legal obligations.

Website and security logs

Technical and security records are retained only for a period reasonably necessary for security, troubleshooting and abuse prevention, subject to the retention settings of the relevant infrastructure provider.

Privacy requests and suppression records

Where you object to recruitment communications or ask us not to contact you again, we may retain limited information in a suppression record so that we can respect your preference in the future.

12. Data accuracy

We take reasonable steps to keep personal data accurate and relevant.

Because professional information changes frequently, we encourage candidates and business contacts to tell us when their details, availability or preferences have changed.

13. Data minimisation

We seek to process only data that is reasonably necessary for the relevant recruitment, contracting, business or legal purpose.

Our recruiters should not request personal information that is unrelated to the nature or requirements of the role or assignment.

14. Security

We implement appropriate technical and organisational measures designed to protect personal data against:

  • accidental or unlawful destruction;
  • loss;
  • alteration;
  • unauthorised disclosure;
  • unauthorised access; and
  • other unlawful processing.

Measures may include access controls, secure cloud infrastructure, encryption where appropriate, anti-abuse controls, authentication controls, logging, backups and staff confidentiality obligations.

No internet transmission or information system can be guaranteed to be completely secure.

15. Your GDPR rights

Subject to the conditions and exceptions provided by applicable law, you may have the right to:

  • obtain confirmation as to whether we process your personal data;
  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request erasure of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • object at any time to processing for direct marketing;
  • request data portability where applicable;
  • withdraw consent at any time where processing is based on consent;
  • receive information about certain automated decisions where applicable; and
  • lodge a complaint with a competent supervisory authority.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Some rights are not absolute and may be subject to legal exceptions.

16. Exercising your rights

To exercise a privacy right or ask a question about this Policy, contact:

privacy@agalta.be

We may request information reasonably necessary to verify your identity before responding to a request. We will not request more identification information than is necessary for that purpose.

We aim to respond within the time limits required by the GDPR.

17. Right to object to recruitment outreach

If we contact you about an opportunity and you do not wish to receive future recruitment approaches, you may tell us at any time.

We will honour the objection and may retain only the limited data necessary to maintain a suppression record so that we do not contact you again inadvertently.

18. Marketing communications

Agalta may contact companies and professional contacts for legitimate business-development purposes, including business-to-business prospecting, where permitted by applicable law.

If Agalta sends newsletters, commercial updates or other direct-marketing communications, we will do so in accordance with applicable GDPR and electronic-marketing rules.

Where consent is required, we will obtain it before sending the communication.

Every electronic marketing message will provide a straightforward method of opting out.

Recruitment communication about a role that is reasonably relevant to your professional profile may be processed separately from general marketing, depending on the context and applicable lawful basis.

19. Cookies and similar technologies

Our use of cookies and similar technologies is described in our separate Cookie Policy.

Cloudflare Web Analytics is optional and runs only after your consent. It provides aggregate page-view and performance measurements without analytics cookies or cross-site tracking. You can reject it or withdraw consent through Privacy settings in the footer. We retain your preference in first-party local storage for 180 days. Security protections remain active independently of analytics consent.

20. Minimum age

Agalta’s recruitment services and website are intended for adults. We do not knowingly collect or process the personal data of anyone under 18, and if we become aware that we have, we will delete it.

21. Complaints

We encourage you to contact us first if you have a privacy concern so that we can try to resolve it.

You also have the right to lodge a complaint with the Belgian supervisory authority:

Data Protection Authority / Gegevensbeschermingsautoriteit / Autorité de protection des données
Rue de la Presse 35 / Drukpersstraat 35
1000 Brussels
Belgium

Website: https://www.dataprotectionauthority.be/

You may also lodge a complaint with another competent EEA supervisory authority, in particular in the country where you normally reside, work or where the alleged infringement occurred.

22. Changes to this Policy

We may update this Privacy Policy to reflect changes in our services, technology, processing activities or legal obligations.

The current version will be published on our website together with the “Last updated” date.

Where a change materially affects how we process personal data, we will take additional steps to inform affected individuals where required by law.