Privacy policy
How Be Consultancy Group BV handles personal data under the Work for International Organizations brand. Questions: gdpr@be-consultancy-group.com.
Short version: your data and your rights on one page, with a request form.
Version 1.0 · 27 October 2026 · BE Consultancy Group, All European Careers and Work for International Organizations are brands of Be Consultancy Group BV.
This notice explains how we handle personal data. Part C adds the rules for bids and framework contracts with international organisations and institutions. Part A is for visitors to our websites, for hiring companies and the people who work there, and for referees. Part B is our Candidate Privacy Notice, for everyone who applies to a vacancy, asks us to represent them, or is approached by us about a role. It is Part 2 of the Candidate Agreement that candidates accept in our forms; Part 1, the Candidate Terms, is published on our terms page.
Part A — Website visitors, hiring companies and referees
A1. Who we are
Be Consultancy Group BV, De Vrièrestraat 54/2, 2000 Antwerpen, Belgium, enterprise number BE 0811.467.950 ("we", "us") is the data controller for everything described in this notice. We operate under three brands, BE Consultancy Group, All European Careers and Work for International Organizations; the company behind all three is the same. We are based in Belgium, and the GDPR and the Belgian Data Protection Act of 30 July 2018 govern how we handle your data.
Privacy contact: gdpr@be-consultancy-group.com.
A2. Website visitors
Visiting our sites. Our hosting provider Cloudflare records technical data in server logs when you visit: IP address, browser type, pages requested, date and time. We use it only to keep the sites secure and running (legitimate interest, Art. 6(1)(f)). Logs are kept for 30 days. We set no tracking cookies. We count visits with Cloudflare Web Analytics, which uses no cookies and does not identify you. The vacancies shown on our jobs page come from our recruitment system and contain no personal data.
Contact and tender forms. We receive what you send through our forms: your name, company, email address, phone number if you give it, and your message or request. We use it to answer you (steps at your request, Art. 6(1)(b)) and keep the exchange for 12 months after our last message, unless it leads to an agreement (section A3) or to a candidate record (Part B).
Profile pages. If you open a link to an anonymised candidate profile that we sent you, we record that the link was opened, so that links can expire and we know an introduction reached you (legitimate interest).
A3. Hiring companies and their contacts
This section is for people who work at companies with open vacancies (hiring managers, talent teams, recruiters, founders) and for our client contacts.
What we collect: your name, job title, company, work email address, work phone number, LinkedIn profile address, the vacancy your company published, our correspondence with you, whether our emails were opened and our links visited, meeting notes, signed terms, and for clients the details needed for contracts and invoicing.
Where it comes from: you; your company's website and published vacancies; the job board or platform where the vacancy was posted; business-contact data providers like Apollo; and our own records under any of our brands.
Why, and on what legal basis:
| What we do | Why (legal basis) |
|---|---|
| Contact you about a candidate who fits a vacancy your company has published | Our legitimate interest in offering our service, and yours in filling a live role (Art. 6(1)(f)). We contact you only about roles your company has published, only at work contact details, and we stop the moment you ask. Where the law of your country requires your prior agreement, we ask for it first. |
| Manage introductions, agreements, interviews and offers once you engage with us | Our agreement with your company (Art. 6(1)(b)) |
| Invoicing, accounting and tax | Legal obligation (Art. 6(1)(c)) |
| Keep a suppression list when you opt out, so we do not contact you again | Legitimate interest and legal obligation |
Opting out. Every message from us has a simple way to stop further contact: reply "no thanks" or use the link. We then add your address, and your company's domain if you ask, to a suppression list that is checked before every send, across email, LinkedIn and phone.
Anonymised profiles you receive are confidential and subject to our terms. You must not attempt to identify the candidate before the full profile is released. Once you hold a candidate's identified profile, your company is a data controller of that data in its own right.
Who receives your data: the service providers listed in Part B, section 7 (our CRM, email, e-signature and file-storage tools), our lawyers, accountants, auditors and insurers, and public authorities where the law requires it. Candidates are told your company's name and the role, never your personal details.
How long we keep it: contacts we approached who did not engage, 12 months after our last message, then deleted, with a minimal suppression record kept if you opted out; client contacts, for the length of the relationship and 7 years after the last contract or invoice, as Belgian accounting and tax law requires; signed terms, 7 years after they end.
Your rights. You can access, correct, erase, restrict, object to and port your data, and complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be) or the authority of the country where you live, in the same way as described in Part B, section 10. International transfers, security and changes to this notice are covered in Part B, sections 8, 11 and 12, and apply to you in the same way.
A4. Referees and people who refer a candidate
If a candidate names you as a referee, we contact you only when that candidate reaches a shortlist, use what you tell us only to assess that candidate, and keep it as part of the candidate's record (Part B, section 9). If you refer someone to us, we keep your name as the source of that referral. You have the rights described in Part B, section 10.
Part B — Candidate Privacy Notice
This is Part 2 of the Candidate Agreement, which candidates accept when they apply to a vacancy, ask us to represent them, or work with us after we approached them about a role. Part 1, the Candidate Terms, is published on our terms page.
1. Who we are
Be Consultancy Group BV, De Vrièrestraat 54/2, 2000 Antwerpen, Belgium, enterprise number BE 0811.467.950 ("we", "us") is the data controller: we decide what happens with your personal data and are responsible for it. We operate under three brands, BE Consultancy Group, All European Careers and Work for International Organizations. Whichever brand you deal with, the company behind it is the same and this notice applies. The GDPR and the Belgian Data Protection Act of 30 July 2018 govern how we handle your data.
Privacy contact: gdpr@be-consultancy-group.com. Use it for any question, request or complaint about your data. Privacy lead: Pablo de Prado Lopez.
2. Two ways to work with us, one agreement
| You apply to a specific vacancy | You ask us to represent you | |
|---|---|---|
| What happens | We assess you for that role and, if suitable and with your go-ahead, present you to that company by name. | We vet you once, then continuously look for live vacancies that fit you, present your anonymised profile to matching companies, and release your full profile only to a company that has signed our terms for you. We tell you every time, and you can stop any introduction. |
| What you give us | The application form, your CV, a short call. | The representation form or an intake interview (45 to 60 minutes), your block-list, the companies you are already talking to, your preferences. |
Whichever way you came to us, you accept one document, the Candidate Agreement, of which this notice is Part 2, and both paths are open to you from then on. Everything here applies equally whether you came to us through our website, a LinkedIn advert, a job board, a referral, a recruiter approaching you, or any of our brands.
3. What data we collect and where it comes from
From you: name, contact details, location and work authorisation, your CV and everything in it (career history, education, skills, languages, certifications, links to professional profiles), your target roles, salary or day-rate expectations, availability and notice period, remote or on-site preferences, companies you are already in process with, companies you would like to work for, your block-list, and anything you tell us in messages or calls.
Created by us while working with you: interview and screening notes, a written assessment of your fit for the roles we handle, the anonymised version of your profile, match proposals and the reasons for them, which companies you were introduced to and when we told you, any introduction you stopped, submission and interview history, feedback from companies, and offer details.
From other people, with your knowledge: references (only at shortlist stage, and we tell you first), interview feedback from hiring companies, and, where you were referred, the name of the person who referred you.
From public professional sources: if a recruiter approaches you rather than the other way round, we will have found you on LinkedIn, GitHub, a job board where you posted your CV, a similar public professional source, or in our own database from an earlier contact under any of our brands. We tell you this at first contact and point you to this notice. If you do not respond within 12 months, we delete what we collected.
Records we keep about the process: the date, time and version of your acceptance of the Candidate Agreement, of which this notice is part, the introduction messages we sent you and any stop request, your objections, delivery and open data for emails we send you, and the source you came from (which advert or page).
What we do not want: please do not send us data about your health, religion, ethnicity, sexuality, political opinions, union membership or criminal record. We do not ask for it and it plays no role in our assessment. If you need an adjustment during the process, for example for an interview, tell us and we record only what is needed to arrange it, with your explicit consent. Where a company legally requires a background or criminal-record check for a specific role, we tell you before anything happens and the company runs it under its own responsibility.
We do not knowingly process data of anyone under 18.
4. What we do with your data and on what legal basis
| What we do | Why (legal basis) |
|---|---|
| Register you, reply to you, book calls, keep your record up to date | Steps you asked for and our agreement with you (Art. 6(1)(b)) |
| Assess your experience and fit: CV review, calls, interview, technical screen, written notes | The same, plus our legitimate interest in presenting suitable candidates (Art. 6(1)(f)) |
| Record and transcribe the intake interview so the recruiter can write accurate notes | Your consent, asked at the start of the call. You can say no; the interview runs exactly the same and notes are then written by hand. |
| Vacancy applications: present you by name to the company whose vacancy you applied to, once we have confirmed the company name with you | Steps you asked for (Art. 6(1)(b)) |
| Representation: create your anonymised profile, match it continuously against live vacancies, present the anonymised profile to matching companies, release your full profile to a company once it has signed our terms, tell you each time, run the process through to offer | Performance of the Candidate Agreement you accepted (Art. 6(1)(b)). Your acceptance is the mandate for all of this; we do not ask again per company. |
| Keep your profile in our talent pool after a specific application closes, so we can contact you about a future role that fits | Our legitimate interest in maintaining a network of professionals (Art. 6(1)(f)). You can object at any time and we stop. |
| Take up references at shortlist stage | Steps you asked for, and our and the company's legitimate interest in verifying what we present. Always announced to you first. |
| Handle the placement: offer, contract paperwork, start date, and for contractors the timesheets, invoicing, payroll or employer-of-record arrangements | Our agreement with you and legal obligations (Art. 6(1)(b) and (c)) |
| Keep the compliance logs: when you accepted the Candidate Agreement, each introduction message and stop request, each match and the recruiter's decision, each anonymisation review | Legal obligations under the GDPR and the EU AI Act (Art. 6(1)(c)), and our legitimate interest in being able to show we kept our promises |
| Handle disputes, for example when two agencies claim the same introduction | Legitimate interest (Art. 6(1)(f)) |
| Send you market and salary insights for your profile | Your consent (separate optional tick), withdrawable any time with one click |
| Comply with the law: tax, accounting, employment-agency rules, requests from courts or authorities | Legal obligation (Art. 6(1)(c)) |
Providing your data is voluntary, but without it we cannot consider you for a role or represent you.
What we never do: sell your data, contact your current employer, use your data for advertising, or make a decision about you by machine alone (section 5). Our websites set no tracking cookies.
5. AI-assisted tools, and the decisions people make
We use AI tools in three places: to read your CV into structured fields, to propose matches between your profile and published vacancies (with a short written reason for each proposal), and to draft documents: your anonymised profile, the recruiter's interview notes from the transcript, and the messages we send to companies.
Every draft is a draft. A recruiter reads it, corrects it and decides. No introduction, submission, rejection or other decision with a significant effect on you is ever made solely by automated means (GDPR Art. 22). In practice:
- a recruiter decides whether we represent you, after interviewing you;
- a recruiter decides which proposed matches are real before anything is sent;
- a recruiter reviews every anonymised profile before it leaves us;
- you set the limits: your block-list, the companies you are already talking to, and the right to stop any introduction.
Under the EU AI Act, AI used in recruitment is classed as high-risk. We are a deployer of such tools and inform you accordingly: people oversee every output, we keep logs of what the AI proposed and what the recruiter decided, and you can ask us at any time what role an AI tool played in a decision about you, ask a person to review that decision, and give your point of view.
Our AI providers process your data only on our instructions under a data processing agreement and may or may not use it to train their models.
6. The representation safeguards (candidate-first)
These rules govern how your data travels. They are commitments in Part 1, the Candidate Terms; this section explains the data side.
- Anonymised first. Until a company has signed our terms for you, it only ever sees an anonymised profile: no name, no contact details, no employer names, and no dates or details that would let someone identify you. A recruiter checks every profile against a deliberate reverse-search (could a motivated hiring manager identify this person with ten minutes on LinkedIn and Google?) and generalises it until the answer is no. We call the profile anonymised because a company cannot identify you from it. In our own hands it remains your personal data and stays protected under this notice.
- Never your employers, never your block-list. Your current and past employers are excluded automatically. Any other company you name, at signup or later by a simple message, goes on your block-list and is never approached about you. The block-list is checked before any profile is sent, and our system blocks the send if that check has not been recorded.
- Your mandate, given once. By accepting the Candidate Agreement, you authorise us to release your full profile to any company that has signed our terms for a role that fits you, within the limits above, without asking you again for each company. This is what lets us move within hours of a company signing.
- We tell you every time. Each time your profile is about to go to a company, we send you the company name and the role, and release your profile before the end of the next business day. Reply STOP and we do not send it, or we withdraw you if it has already gone. You never need to reply to let an introduction go ahead.
- Already in process elsewhere. Tell us at intake which companies you are already talking to, directly or through another agency, and keep that list current. It is the only way we can avoid introducing you twice.
- Only after terms. Your full profile is released only to a company that has signed our terms. Every release is logged with the date, time, company, role and the message we sent you.
- Profile links expire. Anonymised profiles travel through non-guessable, non-indexed links that expire, never as attachments.
- You can pause or leave at any time (section 10).
For direct applications to a vacancy the same principle applies in a simpler form: if the vacancy was published without the company's name, we tell you the company before your details go to them, and you can withdraw.
7. Who receives your data
Hiring companies. For a vacancy you applied to: that company, by name, after confirmation with you. For representation: matching companies receive the anonymised profile; your identified profile only after they have signed our terms, with a message to you each time (section 6). Once a company holds your identified profile it becomes a controller of that data in its own right, and its own privacy notice applies to its selection process.
Service providers (processors) who act only on our instructions, under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Zoho Corporation (Zoho One: Recruit, CRM, Forms, Sign, Bookings, Mail, WorkDrive, Creator, Flow, Analytics, Cliq) | Our candidate system of record, forms, e-signature, scheduling, email, file storage, dashboards | EU |
| Anthropic Ireland, Limited | AI-assisted parsing, matching proposals and drafting (section 5) | Ireland (contracting entity); processing in the USA under the safeguards in section 8 |
| Microsoft Teams, WhatsApp, Wispr and VoipStudio | Interview recording and transcription, with your consent | EU (Teams, WhatsApp), UK (VoipStudio), USA (Wispr) |
| Microsoft Teams, Microsoft 365, Zoho WorkDrive | Email, calendar, documents, internal team chat | EU |
| Cloudflare | Serving our websites and forms | USA |
Vacancy data reaches us from job boards and vacancy-data providers. No candidate data goes to those providers, nor to the tools we use to find hiring contacts at companies.
Others, when relevant: your referees (at shortlist, announced to you); payroll, employer-of-record or umbrella partners for contract placements; our lawyers, accountants, auditors and insurers; public authorities where the law requires it.
LinkedIn and job boards where you applied are independent controllers for what you did on their platform. Their notices apply there.
Our team: members of our team in Spain and Sri Lanka may access your data to support the process; for Sri Lanka, under the safeguards in section 8.
8. Where your data goes (international transfers)
We are based in Belgium and store your data in the EEA. Some providers, or members of our team, are outside the EEA; currently the USA for AI processing, website hosting and dictation, the United Kingdom for telephony, and Sri Lanka, where team members may access records. For every such transfer we rely on a lawful mechanism: an EU adequacy decision (including the EU–US Data Privacy Framework for certified providers), or the European Commission's Standard Contractual Clauses together with a transfer risk assessment. You can ask us for a copy of the safeguards in place.
Wherever you live, this notice and the GDPR apply to you, because we are established in Belgium. If the law of your own country gives you additional rights, you keep them: tell us and we will honour them.
9. How long we keep your data
| Situation | Kept for |
|---|---|
| You applied to a vacancy and were not placed | 12 months after the last contact or decision, then deleted, unless you are in our talent pool (next row) |
| You are represented by us or in our talent pool | While we work together, and 12 months after the last meaningful contact. We check at least every 12 months whether you want to stay; no answer means we delete. |
| You withdraw or object | Active matching stops immediately; your record is deleted within 30 days, except for what the rows below require us to keep |
| Interview recording and transcript | Deleted automatically within 30 days of the interview, once the recruiter's notes are final. The AI-drafted notes are replaced by the recruiter's final notes. |
| You were placed (permanent or contract) | Contract, invoicing and payroll records for 7 years after the placement or contract ends, as Belgian accounting and tax law requires |
| Compliance logs: acceptance of the Candidate Agreement, introduction messages and stop requests, match decisions, anonymisation reviews, block-list | For as long as your record exists, plus 5 years |
| After you ask us to erase you | A minimal suppression record (your name, email and blocked companies) so that we do not contact you or approach a blocked company about you again |
| We approached you and you did not respond | Deleted 12 months after our first message |
| Someone else sends us your CV (a referral) | We contact you within one month with this notice; if you do not want to continue, we delete |
Where a legal claim or investigation is under way, we may keep the relevant data until it is closed.
10. Your rights, and how to use them
You can, at any time and free of charge:
- Access your data and get a copy of it, including our notes about you.
- Correct anything inaccurate or incomplete. Your recruiter can do this on the spot.
- Erase your data, subject to the rows in section 9 that the law requires us to keep.
- Restrict processing while a question about it is being resolved.
- Object to processing based on legitimate interest, including being kept in the talent pool. We then stop unless we can show a compelling reason, which for recruitment we normally cannot, so in practice we stop.
- Take your data with you (portability) in a machine-readable format, for the data you gave us.
- Withdraw consent where consent is the basis (interview recording, insights emails), with no effect on what was done before.
- Ask about AI: what role automated tools played in a decision about you, and have a person review it (section 5).
- Stop a specific introduction by replying STOP to the message we send you, or by telling your recruiter. This has no consequence for anything else.
- Pause or withdraw from representation with a simple message. Introductions already made and in process are closed gracefully: we tell the company you have withdrawn and stop. The per-introduction commitments in Part 1 continue to apply to those introductions.
- Complain to a supervisory authority. Our lead authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be). You can also complain to the data protection authority of the country where you live. We would appreciate the chance to resolve any concern first.
Write to gdpr@be-consultancy-group.com or tell your recruiter. We may need to confirm your identity. We respond within one month; if a request is complex we may take up to two more months and will tell you why.
11. How we keep your data safe
Access to candidate data is limited to the recruiters who work with you and the founder. Roles in our system prevent recruiters from deleting or exporting the database, and compliance fields (your acceptance date, the introduction messages sent to you) are read-only for staff. Anonymised profiles travel through expiring, non-guessable links, never as attachments. Our providers encrypt data in transit and at rest. Interview recordings are deleted automatically. We keep no candidate data in shared spreadsheets or personal drives.
Keep your side safe too: tell us when your contact details change, and treat what we share with you about companies as confidential.
12. Changes to this notice
We may update this notice as our services or the law change. Each version carries a number and a date. If a change affects how we use your data in a material way, we tell you before it takes effect. Where a new purpose would need your agreement, we ask for it; we do not assume it.
13. Contact
Be Consultancy Group BV, trading as BE Consultancy Group, All European Careers and Work for International Organizations · De Vrièrestraat 54/2, 2000 Antwerpen, Belgium · Enterprise number BE 0811.467.950 · gdpr@be-consultancy-group.com
Part C — Bids and framework contracts with international organisations and institutions
This part applies to the work we do under the Work for International Organizations brand. It adds to Part B and changes nothing in it.
C1. Why your CV travels by name
Much of our work for international organisations and institutions runs through tenders and framework contracts. A bid must name its experts, and a request under a framework contract asks for a named CV. For this work your full CV therefore goes, by name, to the consultancy that holds or bids for the contract, and from there to the organisation or institution that evaluates it. We do this under your Candidate Agreement (Art. 6(1)(b)), with these extra rules.
C2. The extra rules
- You decide on every bid. Before your CV goes into a bid or a request under a running contract, we send you the organisation or institution, the role, your daily rate and the consultancy submitting it. Your CV goes in only if you say yes.
- One bid per lot. We never put your CV into two competing bids for the same lot, and we keep a record of every bid your CV is in.
- Your CV in their template. We rewrite your CV in the template the tender requires. You check it before it is used, and we keep each version in your record.
- Statements you sign yourself. Where a tender asks for a signed availability or exclusivity statement, we prepare it and you sign it. Nothing is signed on your behalf.
- Only what the tender asks. Where a contract requires nationality, security clearance or language levels, we record only what the tender asks for, for example whether you hold a clearance and at what level, never the vetting file itself.
C3. Who receives your CV
The consultancy submitting the bid or request, and the organisation or institution evaluating it. Each becomes a controller of your CV in its own right. International organisations may apply their own data protection rules instead of the GDPR; their own notices tell you how.
C4. How long we keep bid records
Bid records (which bid, which lot, which version of your CV, the message we sent you and your answer) are compliance logs, kept as set out in Part B, section 9.