VORM Bouw. B.V. ("VORM") is a nationally operating developer and builder. In order to safeguard the safety of everyone who is at VORM's building sites, VORM uses a workers registration system ("WR System"). In this WR System, VORM registers data about its own employees, hired workers and workers of subcontractors who are (will be) at the building site. When a person is registered in the WR System, he will personally receive a pass which gives him access to the relevant building site. This way VORM can safeguard the quality and safety of building sites.


Data in the WR System

VORM is the controller for the data that are processed in the WR System within the meaning of the General Data Protection Regulation. VORM enters the data of its employees into the system. Data of hired workers or workers of subcontractors are directly entered into the system by the relevant supplier or subcontractor for the purpose of executing the temporary employment contract or contractor agreement. VORM entered into a collaboration agreement with subcontractors in order to safeguard the security and confidentiality of the WR System. For example, subcontractors are obliged to ensure adequate security and to keep checking the accuracy of the data.

The following categories of data are held in the WR System: 

  • Name and surname;
  • Position;
  • Citizen service number ('BSN');
  • Date and place of birth;
  • Nationality;
  • Passport photo;
  • Compulsory certificates and/or diplomas for the execution of the work;
  • Data about performance;
  • Projects you are involved in;
  • Attendance and absenteeism.


In respect of employees, hired workers and workers of subcontractors, VORM is obliged by law to enter the data of these persons, including the Citizen Service Number, in its records.  For own employees and persons from outside the EEA zone, VORM is also obliged to save a copy of the ID (section 28 of the Dutch Wages and Salaries Tax Act and section 15 of the Dutch  Foreign Nationals (Employment) Act).

Data about performance will be included in the WR System in the event of inadequate performance, misconduct and/or conduct in breach of (safety) regulations. More information about this is given in the VORM Safety Protocol.

VORM will not provide personal data to any third parties, unless it is legally obliged to do so or if this is necessary in order to safeguard its legitimate interests. VORM may provide personal data to the Dutch tax authority and/or the inspectorate of the Dutch Ministry of Social Affairs and Employment.

VORM will store the personal data for a minimum of 5 and 7 years after the end of the calendar year in which work was last carried out at/for VORM or after the end of employment, which is in accordance with the statutory retention periods and limitation of vicarious tax and recipients' liability.

Rights of data subject

Under privacy legislation, data subjects whose personal data are held in the WR System have a number of rights.

Right of inspection

Data subjects have a right of inspection. They may contact VORM at reasonable intervals to request an overview of their personal data processed by VORM and may inspect these data.

Right to rectification and addition

Data subjects have the right to have incorrect personal data changed or to add to their personal data, so that VORM only processes current and correct personal data.

Right to restriction of data processing

In certain situations data subjects have the right to have the use of their personal data restricted. Data subjects only have this right in case one of the following situations occurs:

  • The data are possibly incorrect. In this case the processing must be suspended until the correct data have been established;
  • The processing is unlawful and the data subject does not want the data to be removed;
  • The data are no longer required for the purpose for which these were collected, but the data subject does still need the data;
  • The data subject objects against the processing of personal data. In this case the processing must be suspended until a decision is made on the objection.

Right to object

Data subjects have the right to object with regard to data processing that is based on a legitimate interest of VORM. VORM will then have to stop processing the personal data, unless VORM can put forward compelling reasons for the processing that outweigh the interests, rights and freedoms of the data subject or that are related to the institution, execution or substantiation of a legal action. If a data subject lodges a notice of objection, VORM will weigh that data subject's individual interest against the interests of VORM and the persons present at the building sites. The WR System is intended to create a safe working environment, so that only qualified people are working on the building site and, in case of emergencies, VORM will know how to act. It is essential to have quick access to details about the persons present on a building site in case of, for example, a fire or an explosion. Moreover, having unqualified or inadequately performing colleagues working on the building site will create a hazard for everyone, including the colleague himself.

Right to be forgotten

In a number of cases the data subject has the right to have his/her data removed. This right only applies in the following cases:

  • The personal data are no longer required for the purposes for which these were processed;
  • The processing of personal data is based on consent and this consent has been withdrawn;
  • The data subject rightfully exercised his right to object;
  • The personal data are processed in an unlawful manner;
  • The retention periods have expired;
  • The data subject is younger than 16 years.

There are a number of exceptions whereby the right to be forgotten does not apply. The relevant exceptions are as follows:

  • There is a legal obligation to process the personal data;
  • The data are required for a legal action.

Right to data portability

A new right under the General Data Protection Regulation that is in effect from 25 May 2018 is the right to data portability. In so far as VORM processes personal data on the basis of consent or to execute an agreement with the data subject, the data subject has the right to receive these data in a structured, customary and machine-readable format and/or have these transferred to a third party in such a format.

General exception

In exceptional circumstances VORM does not have to comply with the rights of data subjects. This is the case if after weighing up all the interests, VORM reached the conclusion that its interests or those of others outweigh the right of the data subject.

VORM does not use automated decision making and/or profiling. 

Contact person and complaints

Within VORM the VORM Privacy Desk (010 - 642 1307) is the point of contact with regard to questions about the WR System and how it operates. Requests of data subjects with regard to their rights and/or complaints about the processing of personal data can be addressed to the Vorm Privay Desk. Data subjects may also lodge a complaint at the Dutch Data Protection Authority via the website.