Privacy Policy

MVP2 BV/SRL, trading as van Pul & Thieltgen

Version 2.0 | Effective date: 19 August 2026

 

1. Introduction

We make it a matter of pride to respect the privacy of the people we work with and to treat their personal data in the strictest confidence and in accordance with applicable data protection legislation.

This Privacy Policy explains, in a transparent manner, what personal data we collect, why we collect it, how we use it, how long we keep it and what rights you have in relation to it. It applies to candidates, client contacts, referees and visitors to our website.

We encourage you to read it carefully. If you have any question after doing so, please contact us at catherine@vanpul.com.

2. Who is responsible for processing your personal data?

MVP2 BV/SRL, trading as van Pul & Thieltgen, is the controller of your personal data.

Our full contact details are:

  • MVP2 BV/SRL, trading as van Pul & Thieltgen

  • Avenue Louise 428/4, B-1050 Brussels, Belgium

  • Belgian business registry (BCE/KBO) number: 0870.341.891

  • catherine@vanpul.com

We have not appointed a Data Protection Officer, as we are not required to do so. Questions relating to this Privacy Policy are handled directly by the partners.

3. What personal data do we collect?

The personal data we process depends on our relationship with you.

3.1 Candidates and prospective candidates

  • Identification and contact details: surname, first name, professional and private email address, telephone number and, where relevant, city or country of residence.

  • Professional information: your CV, career history, current and previous positions, employers, qualifications, professional certifications, languages and areas of expertise.

  • Information obtained from publicly available professional sources: career history and professional information published on LinkedIn, company websites, professional directories and comparable sources.

  • Interaction records: a summary of our contacts with you, notes of conversations and interviews, and the key points of our exchanges.

  • Assessments: our own evaluation of your experience, skills and suitability for a specific assignment, and, where such a tool is used in a given assignment, the results of a third party assessment instrument.

  • References: information provided by professional referees.

  • Career and remuneration information: current package and remuneration expectations, notice period, availability, mobility criteria and career motivations.

  • Coaching and onboarding records: where you take part in a coaching or onboarding engagement, the reports and notes generated in that context.

  • Any other information you choose to share with us.

Not requested. We do not ask for your date of birth, marital status, family situation or home address, as this information is not necessary for an executive search assignment. If you include it spontaneously, for example in your CV, it remains part of the document you sent us but plays no role in our assessment.

 

3.2 Client contacts and prospective clients

Where you are a contact person at a client organisation or a prospective client, we process your name, job title, professional contact details, the organisation you represent, and a record of our exchanges and of the assignments we carry out for your organisation.

3.3 Referees

Where you act as a professional referee for a candidate, we process your name, job title, professional contact details, your professional relationship with the candidate and the substance of the reference you provide.

3.4 Website visitors

When you use the contact form on vanpul.com, we collect your last name, first name, email address, telephone number where you provide it, and the content of your message. Our website and its hosting infrastructure also process technical data such as your IP address and standard server logs. Information about cookies is set out in section 12 and in our separate Cookie Policy.

3.5 Special categories of personal data

We do not seek to collect special categories of personal data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, or data concerning a person’s sex life or sexual orientation.

Please do not include such information in your CV or in the documents you send us. A photograph included in a CV may implicitly reveal some of this information; we do not use it in our assessment. Where such information reaches us incidentally, for example in the course of a conversation, we do not record it unless we have a lawful basis for doing so and it is necessary for the assignment.

Where, in the context of an interview or of a coaching or onboarding engagement, you choose to share information concerning, for example, your health or wellbeing, we record it only where it is relevant to the engagement and with your explicit consent, which you may withdraw at any time.

4. Why we process your personal data, on what basis, and for how long

We process your personal data only for specified and legitimate purposes, and only to the extent necessary for those purposes. The table below sets out each purpose, the legal basis on which we rely and the period for which we keep the data.

Purpose

Legal basis

Retention period

Identifying and contacting you about current or potential career opportunities relevant to your profile

Our legitimate interests (Art. 6(1)(f) GDPR): operating an executive search practice and connecting senior professionals with relevant opportunities

2 years from our last meaningful contact with you; any new meaningful contact restarts this period

Assessing your professional experience, skills, qualifications and suitability for a specific assignment

Our legitimate interests, and, where you are actively engaged in a process, steps taken at your request prior to entering into a contract (Art. 6(1)(b))

Duration of the assignment, then 2 years

Managing our relationship with you throughout a search process, including interviews, communications and follow up

Our legitimate interests and steps taken at your request (Art. 6(1)(b))

Duration of the assignment, then 2 years

Obtaining and recording professional references

Our legitimate interests, exercised with your knowledge; your consent where this is required

Duration of the assignment, then 2 years

Presenting your profile to a client in connection with a specific assignment

Our legitimate interests, exercised after we have discussed the opportunity with you

Duration of the assignment, then 2 years

Maintaining and updating our candidate database so that we can consider you for future assignments

Our legitimate interests: maintaining a relevant network of senior professionals

2 years from our last meaningful contact; any new meaningful contact restarts this period

Delivering executive coaching and onboarding engagements

Performance of a contract (Art. 6(1)(b)) and our legitimate interests

Duration of the engagement, then 7 years for the related contractual and accounting records

Managing our relationship with clients and prospective clients

Performance of a contract (Art. 6(1)(b)) and our legitimate interests

Duration of the relationship, then 7 years

Communicating with you occasionally about our services, assignments or professional opportunities

Our legitimate interests, subject to your right to object at any time

Until you object or ask us to stop

Responding to enquiries submitted through our website contact form

Our legitimate interests and steps taken at your request

12 months, unless the exchange leads to a longer relationship

Complying with our legal, accounting and tax obligations

Compliance with a legal obligation (Art. 6(1)(c))

As required by Belgian law, generally 7 years

Establishing, exercising or defending legal claims

Our legitimate interests

Until the end of the applicable limitation period

 

Where we rely on our legitimate interests, we assess in each case whether those interests are overridden by your rights and freedoms. You may ask us for information about that assessment by writing to catherine@vanpul.com.

We review the information held in our database periodically and delete or anonymise personal data that is no longer relevant or necessary. Where you ask us to delete your personal data, we will assess your request in accordance with applicable data protection legislation and delete or anonymise the relevant data, unless a legal obligation or a legitimate ground requires us to retain certain information.

5. How do we collect your personal data?

5.1 Information you provide to us directly

We collect personal data that you provide when you contact us, communicate with us by email or telephone, meet us in person or virtually, send us your CV or other documents, or tell us about your professional experience, career preferences and referees.

5.2 Information obtained from publicly available sources

As part of our executive search activities, we identify potential candidates through publicly available professional sources such as LinkedIn, company websites, professional directories and other publicly accessible databases. In such cases we may collect your name, professional position, career history, qualifications and other professional information that is publicly available.

5.3 Information received from third parties

We may receive personal data about you from our clients, professional contacts, candidates, referees or other individuals within our professional network, for example where you are recommended as a potential candidate for a particular assignment.

5.4 Information generated through our interactions with you

In the course of our contacts with you we create and retain notes concerning conversations, interviews, assessments, career preferences, references and other information relevant to a search assignment.

5.5 Where we obtain your personal data from a source other than you

Where we collect your personal data from a source other than you, we will inform you of that fact and provide you with the information required by applicable data protection legislation. We do so when we first make contact with you and, in any event, within one month of collecting your data, unless a legal exception applies.

That information includes the categories of personal data concerned, the source they came from, the purposes for which we process them and the rights available to you.

Where the source is an individual who has asked us not to disclose their identity, we provide you with general information about the nature of the source, for example a recommendation received from a professional contact, taking into account the rights and interests of everyone involved.

6. Who has access to your personal data and with whom do we share it?

Your personal data may be accessed by the partners and staff of MVP2 BV/SRL who need it to carry out their professional duties and to manage our assignments. They are bound by appropriate confidentiality obligations.

Depending on the circumstances and the purpose of the processing, we may share relevant information with:

  • our clients, where this is necessary for a search or recruitment assignment and your profile is being considered for a specific position. We present your profile only after having discussed the opportunity with you, and we share only the information that is relevant and necessary for the client to assess your suitability for the role;

  • professional referees and other professional contacts, where appropriate and, where required, with your knowledge or consent;

  • service providers acting on our behalf, such as providers of secure cloud storage, messaging, CRM or candidate management systems, IT support, website hosting and, where used, assessment tools. These providers act only on our documented instructions and are bound by written data processing agreements imposing appropriate confidentiality and security obligations;

  • professional advisers, such as lawyers, accountants or auditors, where necessary and subject to appropriate confidentiality obligations;

  • public authorities or other third parties, where disclosure is required by law or is necessary to protect our legal rights or to comply with a legal obligation.

We share personal data only to the extent necessary for the relevant purpose and in accordance with applicable data protection legislation. We do not sell your personal data and we do not make it available to third parties for their own marketing purposes.

7. Do we transfer your personal data outside the EEA?

We store and process your personal data primarily within the European Economic Area.

Transfers outside the EEA may nevertheless occur in the course of our activities, in particular where we present a candidate profile to a client established outside the EEA, or where a service provider or one of its sub-processors processes personal data from outside the EEA.

Where such a transfer takes place, we ensure that it is carried out in accordance with Chapter V of the GDPR, on the basis of one of the following mechanisms:

  • an adequacy decision of the European Commission, which is currently the case for the United Kingdom and for a number of other countries;

  • standard contractual clauses adopted by the European Commission, together with any additional measures required following a transfer impact assessment;

  • certification of the recipient under the EU-US Data Privacy Framework, where applicable;

  • any other mechanism or derogation provided for by applicable data protection legislation.

If you would like further information about the location of your personal data or about the safeguards applicable to a specific transfer, please write to catherine@vanpul.com.

8. How do we protect your personal data?

We take the confidentiality and security of your personal data seriously and implement appropriate technical and organisational measures designed to protect it against unauthorised access, loss, destruction, alteration, disclosure or any other form of unlawful or unauthorised processing.

Our candidate database is stored on our own secure systems, under our direct control. Where we use external service providers, for example for messaging, website hosting, backups or, where applicable, candidate management tools, these providers are bound by written data processing agreements requiring them to apply appropriate confidentiality and security measures and to process personal data only for the purposes we specify.

Access to personal data is limited to the members of our team and to the authorised service providers who need it in order to perform their respective functions. Our team members are subject to confidentiality obligations.

Depending on the nature of the data and the circumstances, our measures include access controls, secure authentication, full disk encryption of our computers, encrypted backups of our candidate database, encryption in transit and secure storage, together with measures designed to prevent unauthorised access to our systems.

No method of storing or transmitting information can be guaranteed to be completely secure. We therefore review our security measures regularly and improve them where appropriate.

9. Do we use generative AI?

We may use generative artificial intelligence tools to support certain aspects of our work and to improve the efficiency and quality of our services. These tools may assist us with drafting, summarising, organising or analysing information.

Our use of AI is subject to the same principles of confidentiality, data protection and security that apply to all personal data we process. Where we use AI tools in connection with personal data, we take appropriate measures to:

  • minimise the data processed and use only information that is relevant and necessary for the specific purpose;

  • protect confidentiality and apply appropriate technical and organisational security measures;

  • select appropriate service providers and assess their data protection and security practices;

  • use business or enterprise plans configured so that personal data is not used to train publicly available AI models;

  • maintain human oversight, so that AI generated content or analysis is always reviewed by our consultants and never replaces their professional judgment.

Where an external AI service provider processes personal data on our behalf, we put in place appropriate contractual and technical measures to ensure that the processing complies with applicable data protection legislation. We remain responsible for the personal data we process when using AI tools, and we consider the specific risks associated with AI processing before using such tools in relation to personal data.

If you have any question about how we use AI in relation to your personal data, please write to catherine@vanpul.com.

10. Automated decision-making and profiling

We do not take decisions concerning you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Every assessment and every recommendation we make in the course of a search assignment is the result of the professional judgment of our consultants.

11. What are your rights and how can you exercise them?

Under applicable data protection legislation you have a number of rights in relation to your personal data, subject to certain conditions and limitations. Depending on the circumstances, these include:

  • The right of access: you may ask us whether we process personal data about you and, where we do, request a copy of that data.

  • The right to rectification: you may ask us to correct or complete inaccurate or incomplete personal data.

  • The right to erasure: you may ask us to delete your personal data where there is no longer a valid reason for us to retain it.

  • The right to restriction of processing: in certain circumstances you may ask us to restrict the processing of your personal data.

  • The right to object: you may object to processing based on our legitimate interests. You may also object at any time, and without giving reasons, to the use of your personal data for direct marketing purposes.

  • The right to data portability: in certain circumstances you may ask to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or ask us to transmit it to another organisation.

  • The right to withdraw consent: where we process your personal data on the basis of your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

  • The right not to be subject to automated decision-making, as described in section 10.

To exercise your rights, please contact us at catherine@vanpul.com. We may need to ask for additional information in order to verify your identity before responding.

We will respond without undue delay and in principle within one month of receiving your request. Where a request is complex or where we receive a number of requests, that period may be extended by two further months, in which case we will inform you within the first month.

12. Cookies and our website

Our website uses cookies and similar technologies. Cookies that are not strictly necessary for the website to function are placed only after you have given your consent, which you may withdraw at any time.

Full information about the cookies we use, their purpose and their duration, and about how to give, refuse or withdraw your consent, is set out in our Cookie Policy, available at vanpul.com.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, in the services we use, in applicable data protection legislation or in other relevant developments.

The most recent version is always available on our website. The version number and effective date shown at the top of this document indicate when it was last updated. Where a change is significant, we will draw your attention to it directly or by means of a notice on our website.

14. Questions, complaints and disputes

If you have a question, a concern or a complaint about the way we process your personal data, we encourage you to contact us first at catherine@vanpul.com. We will make every reasonable effort to understand your concern and to find an appropriate and amicable solution.

You also have the right to lodge a complaint with the Belgian Data Protection Authority if you believe that your personal data is being processed in breach of applicable legislation:

  • Autorite de protection des donnees / Gegevensbeschermingsautoriteit

  • Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium

  • contact@apd-gba.be

  • www.dataprotectionauthority.be

Where you are based in another country of the European Economic Area, you may also lodge a complaint with the supervisory authority of your country of residence or place of work.