Privacy Policy
Last updated: September 16, 2026
This Privacy Policy explains how Ekspats B.V. (“Ekspats”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data when individuals visit or interact with ekspats.com and related public Ekspats web pages. It is intended to provide clear information about website-related personal data processing. Use of Spark, Spark Pro and related platform services may also be subject to a separate Spark Privacy Policy, Terms of Use and other applicable platform documentation.
1. Who we are
Ekspats B.V. (“Ekspats”, “we”, “us” or “our”) is a company incorporated under the laws of the Netherlands, with its registered address at Keizersgracht 520H, 1017 EK Amsterdam, the Netherlands.
For the purposes of the General Data Protection Regulation (“GDPR”), Ekspats B.V. is the data controller for personal data processed through ekspats.com and related public Ekspats web pages, unless otherwise stated.
Contact:
E-mail: info@ekspats.com
Address: Keizersgracht 520H, 1017 EK Amsterdam, the Netherlands
2. Scope of this privacy policy
This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit or interact with ekspats.com and related public Ekspats web pages.
It applies in particular to personal data processed through:
a. website visits and browsing activity;
b. contact forms and enquiries;
c. support or partnership enquiries submitted through the website;
d. newsletter, event or marketing registrations, where offered;
e. website analytics, campaign measurement, security and operational logs;
f. cookie and consent management;
g. other public website interactions with Ekspats.
If you create or use a Spark or Spark Pro account, upload a CV, use matching features, access a candidate, company or recruiter dashboard, or otherwise use the Spark platform, additional processing may be governed by the separate Spark Privacy Policy and applicable platform terms.
3. Personal data we may collect
3.1. Information You Provide Directly
When you contact us or submit information through the website, we may process information such as:
a. first name and last name;
b. e-mail address;
c. phone number, where provided;
d. company or organisation name, where relevant;
e. role or professional information, where relevant;
f. the subject and content of your message;
g. any other information you choose to provide in a website form or communication.
3.2. Marketing and Communication Data
Where you subscribe to a newsletter, event, update or other marketing communication, we may process:
a. your name and contact details;
b. subscription or consent status;
c. unsubscribe or opt-out status;
d. campaign or source information;
e. delivery, open or click information where available and permitted by law.
3.3. Website Usage, Technical and Security Data
When you use our website, we may process technical or usage information such as:
a. IP address;
b. browser type and version;
c. device type and operating system;
d. pages viewed and interactions with the website;
e. date and time of access;
f. referring page or source;
g. campaign, referral or UTM information;
h. session identifiers;
i. security, diagnostic and error logs;
j. cookie or consent preference information.
3.4. Cookies and Similar Technologies
Our website may use cookies and similar technologies for website functionality, consent management, analytics, preferences, security and, where permitted, marketing or advertising measurement. Detailed information about the cookies and similar technologies used on our website is provided in our separate Cookie Policy and consent preference centre.
Where consent is required by applicable law, non-essential cookies or similar technologies will be used only after the required consent has been obtained.
4. How we collect personal data
We may collect personal data:
a. directly from you when you submit a contact form, send an enquiry, subscribe to communications or otherwise communicate with us;
b. automatically when you use the website through technical logs, security tools, analytics tools and similar technologies;
c. from cookie and consent management tools;
d. from service providers that support website hosting, security, communications, analytics or campaign measurement;
e. from referral or campaign sources where you arrive at our website through a tagged or tracked link, where permitted by applicable law.
5. Why we process personal data and legal bases
The table below summarises the main purposes, categories of data, legal bases and general retention approach for website-related processing.
| Purpose | Main personal data categories | Main legal basis | General retention approach |
|---|---|---|---|
| Contact forms and enquiries | Identity, contact, message and relevant professional/business information | Steps prior to entering into a contract where applicable; legitimate interests in responding to enquiries and managing business communications | For as long as needed to respond, follow up, manage the relationship and meet legal or dispute requirements |
| Website operation and security | Technical, device, session, security and diagnostic data | Legitimate interests in operating, securing, troubleshooting and protecting the website; legal obligation where applicable | Only as long as reasonably necessary for operational, security, fraud-prevention or legal purposes |
| Website analytics and measurement | Usage, device, referral, campaign and consent-related data | Consent where required by law; legitimate interests only where permitted by applicable law | According to applicable consent settings, provider settings and our operational retention needs |
| Marketing communications | Identity, contact, consent, opt-out and campaign interaction data | Consent where required; legitimate interests only where permitted by applicable law | Until consent is withdrawn or an opt-out is recorded, with limited records retained as necessary to demonstrate compliance |
| Legal compliance and protection of rights | Relevant contact, communication, technical, contractual and compliance records | Legal obligation; legitimate interests in establishing, exercising or defending legal claims and preventing misuse | As required or permitted by applicable law |
6. Marketing communications
We may send newsletters, event invitations, product updates, partner information, campaigns or other promotional communications only where permitted by applicable law and, where required, with your prior consent.
You may withdraw consent or unsubscribe from marketing communications at any time by using the unsubscribe method provided in the relevant communication or by contacting us at info@ekspats.com.
Withdrawing consent or opting out of marketing does not affect communications that are necessary to respond to an enquiry, administer an existing relationship, provide requested information, maintain security or comply with legal obligations.
7. Sharing personal data
We may share personal data only where necessary for the purposes described in this Privacy Policy, including with:
a. website hosting, infrastructure and security providers;
b. cookie and consent management providers;
c. analytics, logging and measurement providers;
d. e-mail, communication, CRM or support providers;
e. professional advisers, including legal, accounting and compliance advisers;
f. service providers supporting website maintenance, development or technical operations;
g. public authorities, regulators, courts or other parties where disclosure is required by law or necessary to establish, exercise or defend legal claims.
If Ekspats is involved in a merger, acquisition, investment, restructuring, financing, asset sale or similar transaction, personal data may be disclosed where reasonably necessary for the transaction and subject to applicable confidentiality and data protection safeguards.
8. International data transfers
Because Ekspats operates internationally and may use service providers in different countries, personal data may be processed outside the Netherlands or the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA and applicable law requires additional safeguards, we will use appropriate transfer mechanisms, such as an adequacy decision, Standard Contractual Clauses or other lawful contractual, technical or organisational safeguards.
9. Data retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.
Retention periods may depend on the type of data and purpose. In particular:
a. contact and enquiry data may be retained for as long as necessary to respond, follow up and manage the relevant relationship or request;
b. marketing preferences and consent or opt-out records may be retained for as long as necessary to manage communications and demonstrate compliance;
c. technical, analytics, security and consent data may be retained according to operational, security, legal and provider-specific retention settings;
d. legal, contractual, accounting, dispute or compliance records may be retained for longer periods where required or permitted by law.
Where personal data is no longer required, we will delete, anonymise or otherwise restrict it as appropriate.
10. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include access controls, authentication, encryption where appropriate, security monitoring, logging, contractual confidentiality obligations and role-based access controls.
No electronic system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess the incident and take any notification or remediation steps required by applicable law.
11. Your privacy rights
Subject to applicable law, you may have the right to:
a. obtain information about how your personal data is processed;
b. request access to your personal data;
c. request correction of inaccurate or incomplete personal data;
d. request deletion of personal data where applicable;
e. request restriction of processing;
f. receive certain personal data in a portable format where applicable;
g. object to processing based on legitimate interests in certain circumstances;
h. object to direct marketing;
i. withdraw consent at any time where processing is based on consent;
j. lodge a complaint with a competent data protection authority.
To exercise your rights, contact us at info@ekspats.com. We may need to verify your identity before completing a request.
We will respond within the timeframe required by applicable law and may refuse or limit a request only where permitted by law.
If you are located in the Netherlands, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If you are located elsewhere in the EEA, you may also contact your local supervisory authority.
12. Spark and other Ekspats services
The public Ekspats website may contain links or calls to action that direct you to Spark, Spark Pro or other Ekspats services.
If you choose to create or use a Spark account, additional categories of personal data may be processed, including account data, CV and career data, subscription information, hiring workflow data and platform usage information. Those processing activities are described in the separate Spark Privacy Policy and related platform documentation.
13. Third-party links
Our website may contain links to third-party websites, platforms or services. We are not responsible for the privacy practices, security or content of third parties. We encourage you to review the privacy information of any third-party service before providing personal data.
14. Changes to this privacy policy
We may update this Privacy Policy from time to time to reflect changes in our website, services, legal requirements or data processing practices.
The current version will be published on our website with the applicable “Last updated” date. Where required by law, we will provide additional notice of material changes.
15. Language
This Privacy Policy is prepared in English. Any translation may be provided for convenience and understanding only.
If there is any inconsistency between the English version and a translation, the English version will prevail, unless applicable law requires otherwise.
16. Contact us
If you have questions about this Privacy Policy, wish to exercise your privacy rights or have concerns about how we process personal data, contact us at:
Ekspats B.V.
Keizersgracht 520H
1017 EK Amsterdam
The Netherlands
E-mail: info@ekspats.com