Interested?
Candidate Privacy Notice
How we handle your personal data when you apply for a role with us
Last updated: 17-09-2026
1. Who we are
Thrivin Fitness B.V. is the data controller responsible for the personal data you provide when you apply for a role with us.
If you have any questions about this notice or about how we handle your personal data, contact us at privacy@thrivin.com.
| Controller | Thrivin Fitness B.V. |
| Registered address | 22 Stoevelaarhoek, 7546GA Enschede, Netherlands |
| KvK (Dutch Chamber of Commerce) number | 93548508 |
| Privacy contact | privacy@thrivin.com |
If you have any questions about this notice or about how we handle your personal data, contact us at privacy@thrivin.com.
2. What personal data we collect
When you apply through our careers page, we collect:
- Your name
- Your email address
- Your phone number
- Your CV / résumé
- Your cover letter, if you choose to provide one
- Your work history
- Your education history
- The role or roles you are applying for
- Any other information you choose to provide through the application form (including any answers to application questions or supporting information you upload)
We also collect information generated during the recruitment process itself, such as interview notes, assessment or task results, and any references we obtain with your permission.
Where we record or transcribe interviews or assessments (including any automated notetaking), we will tell you in advance and collect the resulting audio, video, and transcripts.
We also collect records of our communications with you (such as emails and call logs) and limited technical information generated when you use our careers page and application form (such as IP address and device or browser information).
We may also receive personal data about you from third-party sources such as recruiters you engage, professional networking platforms you choose to use for applying, and (where applicable) background-check or right-to-work verification providers.
We do not ask you to provide special category data (such as information about your health, religion, ethnicity, or sexual orientation) as part of your application. Please do not include such information in your CV or cover letter unless it is necessary for us to make a reasonable adjustment for you during the process. If we receive special category data, we will process it only where necessary to make a reasonable adjustment (on the basis of Article 9(2)(b) GDPR, as implemented by Article 30 of the Dutch UAVG — processing necessary for carrying out obligations in the field of employment law) or to meet our other legal obligations. We will limit access to those who need to know and will delete or redact the data where it is not needed for those purposes.
3. Why we collect it
We process your personal data in order to:
- assess your suitability for the role you have applied for;
- manage and administer the recruitment process, including contacting you, scheduling interviews, and giving you feedback;
- verify the information you have provided, including your right to work;
- keep a record of the recruitment decision for the purpose of defending against potential legal claims; and
- where you have given us your consent, consider you for future roles at Thrivin (Thrivin Fitness B.V.).
4. Our lawful basis for processing
| Purpose | Lawful basis |
|---|---|
| Assessing your application for the specific role you applied for, and managing the recruitment process | Necessary for pre-contractual steps taken at your request: Article 6(1)(b) GDPR. You have applied for a role, and we need to process your data in order to assess your application and take steps towards potentially entering into an employment contract with you. For keeping records of recruitment decisions in order to defend against potential legal claims, we rely on our legitimate interests — Article 6(1)(f) GDPR. |
| Keeping your details on file so we can contact you about future roles | Your consent: Article 6(1)(a) GDPR, given by ticking the optional box on the application form. |
| Verifying your right to work | Compliance with our legal obligations: Article 6(1)(c) GDPR. |
Where we rely on your consent to keep your details on file, you can withdraw that consent at any time by emailing privacy@thrivin.com. Withdrawing consent does not affect your application for the role you originally applied for, and it does not affect the lawfulness of any processing we carried out before you withdrew it.
5. Who receives your data
Your personal data may be shared with:
- Thrivin colleagues involved in the hiring process — the hiring manager for the role, and members of our People and leadership teams who need to be involved in the decision. Access is limited to those who need it.
- Shopify Inc. — which hosts the careers page and the application form through its Shopify Forms product and therefore processes submissions on our behalf as a data processor.
- We require our recruitment service providers that process personal data on our behalf to act as data processors under a written agreement that includes appropriate confidentiality, security, and sub-processing obligations, including maintaining appropriate technical and organisational measures to ensure data security, consistent with Article 28 GDPR.
- Reference providers — the referees you nominate, who we will only contact at offer stage and with your prior permission.
- A buyer or successor — if all or part of our business or assets is sold, transferred, or reorganised, in which case your data may be disclosed to the prospective or actual new owner.
We do not sell your personal data, and we do not share it with anyone for marketing purposes. This notice covers how we use application and recruitment data; any cookies or similar technologies used on our website are described separately, and we do not use your application data for marketing analytics or advertising.
6. How we protect your data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include access controls, secure storage, and regular assessment of our security practices.
7. Transfers outside the EEA
Some of the providers we use to host our careers page and store applications process data outside the European Economic Area (the "EEA") and the United Kingdom, including in the United States. Where your personal data is transferred outside the EEA or the UK, we make sure it is protected by an appropriate safeguard. Depending on the provider and transfer, this may include the European Commission's Standard Contractual Clauses (standard data protection clauses approved by the European Commission for international transfers) (or, for UK transfers, the UK International Data Transfer Agreement (the UK's standard data transfer contract) or UK Addendum (the UK Addendum to the EU Standard Contractual Clauses)), and/or transfer to a recipient that is certified under the EU-US Data Privacy Framework (a certification framework for US companies receiving EU personal data) or the UK Extension to the EU-US Data Privacy Framework (where applicable).
You can request a copy of the safeguards we rely on by contacting privacy@thrivin.com.
8. How long we keep your data
Personal data of unsuccessful candidates will be retained for 4 weeks from the date the role is filled or the application is declined, unless you have consented to a longer retention period. At the end of the applicable period we delete or anonymise your data. Where we need to keep certain limited records for longer in order to defend against a legal claim, we will only keep what is necessary for that purpose and for no longer than the applicable statutory limitation period.
If you want us to keep your details on file for future roles, your data will be retained for up to one year from your application date (or until you withdraw your consent, whichever is earlier). We may contact you before the end of that period to ask whether you would like to renew your consent.
If you are successful and join Thrivin, your application data is retained in line with our Privacy Policy.
9. Your rights
Under the GDPR (and, for candidates in the United Kingdom, the UK GDPR) you have the right to:
- Access — ask for a copy of the personal data we hold about you;
- Rectification — ask us to correct personal data that is inaccurate or incomplete;
- Erasure — ask us to delete your personal data, where there is no overriding reason for us to keep it;
- Restriction — ask us to limit how we use your personal data while a concern is being resolved;
- Portability — ask us to provide the personal data you gave us in a structured, commonly used, machine-readable format, or to transmit it to another controller;
- Object — object to our processing of your personal data where we rely on our legitimate interests. Note: our processing of your application data is based on pre-contractual necessity, not legitimate interests, so this right does not apply to the core assessment of your application;
- Withdraw consent — withdraw your consent at any time where we rely on consent, as described in section 4.
To exercise any of these rights, email privacy@thrivin.com. This notice applies specifically to recruitment and applications; our general privacy information may describe different rights or exceptions depending on the processing activity. To protect your data, we may need to verify your identity before acting on your request. We will respond within one month of receiving your request, or notify you if we need an extension of up to two additional months due to complexity.
If you are not satisfied with how we have handled your personal data, you can complain to a supervisory authority:
| Netherlands | Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl |
| United Kingdom | Information Commissioner's Office — ico.org.uk |
| United States | If you are based in a US state that grants specific privacy rights (such as California), please contact privacy@thrivin.com for information about how to exercise those rights. |
You may also complain to the supervisory authority in the EU country where you live or work.
10. Is providing your data required?
Some of it, yes. We cannot assess or process your application without the personal data marked as required on the application form (such as your name, contact details, and CV), so providing that information is a requirement of applying. If you choose not to provide it, we will not be able to consider you for the role.
The optional fields on the form — e.g. the future-roles consent box — are genuinely optional, and choosing not to complete them will not count against your application.
11. Decision-making
Human review only: We do not use automated decision-making or profiling to assess applications. Every application is reviewed by a member of our team.
We may update this notice from time to time. The version that applied when you submitted your application is the one that governs how we handle your data. Where we make a material change that affects candidates whose data we still hold, we will use reasonable efforts to notify those candidates.