Privacy Policy

Effective date: 20 May 2026  |  Version: 1.0

1. Introduction

Invisix B.V. ("Invisix", "we", "us" or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal data processed through our website at https://invisix.com. We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, the "UAVG").

2. Controller

Invisix B.V. is the controller within the meaning of Article 4(7) GDPR.

• Name: Invisix B.V.
• Statutory seat: Eindhoven, the Netherlands
• Chamber of Commerce (KvK) number: 97757772
• VAT (BTW) number: NL868218297B01
• Website: https://invisix.com
• Email: info@invisix.nl

Invisix has not appointed a Data Protection Officer (DPO) within the meaning of Article 37 GDPR. Privacy-related queries can be addressed to the contact details above.

3. Personal data we process

We process the following categories of personal data through our website.

3.1 Contact form data

When you submit our contact form, we process your name, email address and the content of your message. Any additional data you choose to provide voluntarily (such as company name or telephone number) is also processed.

3.2 Communication data

When you contact us by email or otherwise communicate with us, we process the content of that communication and any personal data you include in it.

3.3 Website usage data

We process technical data through Google Analytics 4, deployed via Google Tag Manager. This may include your IP address (truncated where supported), device and browser information, the referring URL, pages visited, time on page and approximate location derived from your IP address. Google Analytics 4 is configured in line with the guidance issued by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), where applicable.

We do not process special categories of personal data within the meaning of Article 9 GDPR through our website.

4. Purposes and legal bases

We process personal data only when we have a lawful basis under Article 6(1) GDPR. The table below sets out the purposes for which we process personal data and the corresponding legal basis.

Where our processing is based on legitimate interests, we have carried out a balancing test and concluded that our interests are not overridden by your interests, rights or freedoms. Details of this assessment are available on request.

5. Cookies and similar technologies

Our website uses cookies and similar technologies, deployed through Google Tag Manager. We distinguish between:

• Functional cookies, strictly necessary to operate the website. These do not require consent.
• Analytical cookies (Google Analytics 4), used to measure how the website is used. These are placed only after you have given consent through our cookie banner, in accordance with Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet).

You can withdraw your consent at any time through the cookie settings on our website or by clearing the cookies in your browser. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. Recipients and processors

We share personal data only with the following categories of recipients, and only to the extent strictly necessary:

• Hosting and IT service providers that operate our website infrastructure and store form submissions on our behalf.
• Google Ireland Limited and Google LLC, providers of Google Analytics 4 and Google Tag Manager, acting as our processors.
• Email service providers used to receive and respond to communications.
• Professional advisors (legal, accounting, tax) where strictly necessary.
• Competent public authorities or regulators, where we are required to do so by law or court order.

We conclude data processing agreements with all processors in accordance with Article 28 GDPR.

7. International transfers

Some of our processors are located outside the European Economic Area (EEA), in particular Google LLC in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards within the meaning of Chapter V GDPR. These safeguards include the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), the EU-U.S. Data Privacy Framework (Article 45 GDPR adequacy decision) where applicable, and supplementary measures where required by the EDPB recommendations following the Schrems II ruling. A copy of the safeguards in place is available on request via info@invisix.nl.

8. Retention periods

We do not retain personal data longer than necessary for the purposes set out in this Privacy Policy.

• Contact form submissions and related correspondence: up to 24 months after the last contact, unless a longer retention period is required to establish, exercise or defend legal claims, or is mandated by law.
• Website analytics data: a maximum of 14 months in Google Analytics 4.
• Statutory retention periods, such as the seven-year fiscal retention period under the Dutch General Tax Act (Algemene wet inzake rijksbelastingen), take precedence where applicable.

9. Your rights

Under the GDPR you have the following rights with regard to your personal data:

• Right of access (Article 15 GDPR).
• Right to rectification (Article 16 GDPR).
• Right to erasure, also known as the right to be forgotten (Article 17 GDPR).
• Right to restriction of processing (Article 18 GDPR).
• Right to data portability (Article 20 GDPR).
• Right to object to processing (Article 21 GDPR), including an unconditional right to object to processing for direct marketing purposes.
• Right to withdraw consent at any time (Article 7(3) GDPR), where processing is based on consent.
• Right not to be subject to a decision based solely on automated processing, including profiling (Article 22 GDPR). Invisix does not engage in automated decision-making producing legal or similarly significant effects.

You can exercise your rights by sending a written request to info@invisix.nl. We may ask for additional information to verify your identity. We respond within one month of receiving your request, with a possible extension of two further months for complex or numerous requests, in accordance with Article 12(3) GDPR.

10. Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague, the Netherlands, www.autoriteitpersoonsgegevens.nl, or with the supervisory authority of the EU Member State of your habitual residence, place of work or alleged infringement. This is without prejudice to any other administrative or judicial remedy available to you, including the right to an effective judicial remedy under Article 79 GDPR.

11. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, in accordance with Article 32 GDPR. These measures include transport-layer encryption (TLS), access controls, the principle of least privilege, regular software updates and security monitoring. No transmission over the internet is fully secure; you communicate with us through this website at your own risk.

12. Personal data breaches

In the event of a personal data breach, we will notify the Dutch Data Protection Authority within 72 hours of becoming aware of the breach where required by Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay in accordance with Article 34 GDPR.

13. Children

Our website is not directed at children under the age of 16 and we do not knowingly collect personal data from children. If you believe that we have collected personal data from a child without proper consent, please contact us via info@invisix.nl so that we can take appropriate action.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available at https://invisix.com/privacy-policy/. Material changes will be communicated through our website. The effective date at the top of this Privacy Policy indicates when the latest version entered into force.

15. Governing law

This Privacy Policy is governed by Dutch law and the directly applicable provisions of the GDPR. Any dispute arising out of or in connection with this Privacy Policy will be submitted to the exclusive jurisdiction of the competent court in Oost-Brabant, location 's-Hertogenbosch, the Netherlands, without prejudice to your statutory right to lodge a complaint with a supervisory authority or to pursue any judicial remedy under Article 79 GDPR.

16. Contact

For all privacy-related questions or to exercise your rights, please contact us:

• Invisix B.V.
• Statutory seat: Eindhoven, the Netherlands
• Email: info@invisix.nl
• KvK: 97757772 | VAT: NL868218297B01

Invisix — Candidate Privacy Notice

1. About this notice

Invisix B.V., trading as Invisix Measuring Systems ("Invisix", "we", "us"), is the controller of the personal data we hold about you when you apply for a role with us, or when we consider you for one. This notice sets out what data we collect, the purposes for which we use it, how long we retain it, and the rights available to you under the General Data Protection Regulation (GDPR).

• Invisix B.V., trading as Invisix Measuring Systems
• Willemstraat 1E, Eindhoven, The Netherlands
• Chamber of Commerce (KvK): 97757772
• Privacy contact: hr@invisix.nl
• For questions regarding this notice or the processing of your personal data, please contact us by email.
•  

2.The personal data we collect

Depending on the role and the stage you reach, we may process:

• Identity and contact details: name, email address, telephone number, and postal address.
• Application content: CV, cover letter, employment history, education, qualifications, skills, and references.
• Recruitment records: interview notes, assessment and test results, scorecards, and our correspondence with you.
• Eligibility information: confirmation of your right to work in the Netherlands.
• Screening information: the results of any background checks that apply to the role (see section 5).
• Any further information you choose to provide during the process.

We do not request special category data (such as data concerning health, religious beliefs, ethnic origin or political opinions) as part of recruitment. We also do not ask applicants to provide a copy of their passport, identity card or BSN during recruitment unless legally required. Please do not include such data in your application unless we specifically request it and explain why.

 3. How we obtain your data

• Directly from you, when you apply or correspond with us.
• From professional sources you have made public, such as LinkedIn, where relevant to the position applied for. We do not routinely monitor or review private social media accounts.
• From referees you have nominated. We will not normally seek references without informing you beforehand.
• From background-screening providers, where checks apply to the role and with your knowledge.

4. Our purposes and legal bases and decision-making

We do not make recruitment decisions solely on the basis of automated processing or automated decision-making within the meaning of Article 22 GDPR. Our recruitment decisions involve human review and assessment by Invisix personnel.

5. Background and pre-employment screening

For certain roles we carry out screening appropriate to the position. This may include verification of identity, right to work, qualifications, employment history, and references, and, where relevant, a Certificate of Good Conduct (Verklaring Omtrent het Gedrag, VOG). We will tell you which checks apply before we carry them out.

6.Who we share your data with

• Invisix personnel involved in the hiring decision, such as the hiring manager and interview panel.
• Recruitee, our applicant tracking system provider, which hosts candidate data within the EU under a data processing agreement. Recruitee acts as a processor on our behalf under a data processing agreement.
• Background-screening providers, where checks apply to the role.
• IT and communication providers, such as Microsoft 365, that support our operations under appropriate agreements.
• Authorities or professional advisers, where we are legally required to disclose, or where necessary to establish or defend a legal claim.

We do not sell your personal data, and we do not use it for marketing or advertising.

7. Security and Storing data outside the EEA

Security of your personal data: We take appropriate technical and organizational measures to protect candidate personal data against loss, misuse, unauthorized access, disclosure or alteration, including role-based access controls, secure cloud environments and confidentiality obligations.

We aim to keep your personal data within the European Economic Area (EEA). Our applicant tracking system, Recruitee, stores candidate data in the EU. Some service providers, such as Microsoft, are based outside the EEA or may process limited data outside it. Where this occurs, we rely on safeguards approved under the GDPR, such as the European Commission’s Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework

8. How long we keep your data

• If your application is not successful, we will delete your data within four weeks of the process ending, unless you consent to us keeping it.
• With your consent, we retain your details in our talent pool for up to one year (the Dutch regulator’s recommended maximum, confirmed reasonable by the Dutch Data Protection Authority), after which we will delete them or ask whether you wish to remain. You may withdraw your consent at any time.
  Withdrawal of consent does not affect the lawfulness of processing carried out before consent is withdrawn.
• If you are appointed, your application data becomes part of your employee record and is retained under our employee data retention policy.

9.Your rights

You have the right to:

• Request a copy of the data we hold about you.
• Have inaccurate data corrected.
• Request erasure of your data.
• Object to, or request that we restrict, our use of it.
• Receive your data in a portable format.
• Withdraw consent at any time, where we rely on it.

To exercise any of these rights, contact hr@invisix.nl. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would welcome the opportunity to resolve any concern with you first.

10. Changes to this notice

We may update this notice from time to time. Last updated: 9 July 2026.