Privacy Statement

ACE + Company B.V., consisting of ACE Management Consulting, ACT Regtech Solutions and Atomic Interim Professionals, (hereinafter “ACE”) considers the protection of personal data of its website visitors, job seekers, candidates and business associates of great importance. You can rest assured that personal data will be handled carefully, in accordance with the General Data Protection Regulation (GDPR) and only for the purpose for which the data was obtained.

Who are we?

ACE is the first port of call for financial institutions in understanding, structuring and orchestrating the implementation of (new) laws and regulations. ACE, located in Amsterdam at Zuidplein 156 is “processing controller” as defined by the GDPR for the processing of personal data described in this privacy statement.

This Privacy Statement applies to ACE’s data processing operations in the context of relationship and customer contact, contact with applicants, candidates, consultants and advisors, external and business relations, as well as data processing operations that take place through ACE’s websites:

When does ACE collect personal data?

Among other things, we collect personal data when:

  • want to come and work for ACE (internally or externally);
  • you fill in or leave your details on our website, via e-mail or at our office;
  • you are registered to make use of our activities, services and/or newsletters;
  • you have (had) contact with an ACE employee;
  • this is opportune in the context of a business relationship that ACE maintains with you/your organisation;
  • you visit our website.

What does ACE use personal data for?

ACE can only perform its services properly if personal data is processed in the process. ACE processes personal data to provide targeted information about our services, but also for entering into, and performing agreements, complying with legal provisions and improving the website. ACE also processes data for the following purposes:

Improve website
We record data about your visit to our website in order for it to function optimally. Which data we process depends on the cookie setting you have selected. 

Provision of services
ACE needs personal data for the provision of services. For example, profiles of professionals are offered to (potential) customers. Further information about this can be found in the Privacy Statement for employees. 

Marketing and relationship management
To provide offers for and/or the provision and exchange of information for the benefit of the services and other activities of ACE. ACE maintains a central customer administration.

ACE processes personal data in order to be able to communicate with you. We can communicate with you by means of the contact form on the website, e-mail, telephone or by post. 

Personal data shared with ACE by job applicants will only be used by ACE to carry out an effective and efficient application process. Personal data provided to ACE will only be processed for recruitment and selection purposes. These purposes are:

  • matching the applicant’s personal data to ACE’s existing vacancies;
  • communicating ACE’s application process;
  • the scheduling of job interviews;
  • testing applicants in the form of any personality tests, cases or whatever other ability test is plausible during an application process;
  • contacting the applicant with information about any other suitable vacancies at ACE.

On what grounds does ACE process personal data?

ACE only processes personal data if there is a legal ground for doing so. The legal grounds are:

You have given consent (implicitly or explicitly). We only ask for your consent if it is necessary for processing your personal data. If we process your personal data based on your consent, you can withdraw your consent at any time. 

The processing is necessary for the execution of the agreement such as, for example, if we have entered into an agreement with you/your organisation. If you do not agree to the processing of certain necessary data, in many cases we will not be able to provide our services to you.

Legal obligation
The processing is necessary to comply with a legal obligation.  This ground can also be invoked by ACE in an HR context. For example, ACE must process a copy of the identity data in order to comply with tax law obligations.

Vital interest
The processing is necessary to be able to deal with calamities correctly. This ground will hardly ever occur in an HR context. It has to do with situations in which ACE cannot ask consent and actions are essential for the life of the employee.

Legitimate interest
The processing is necessary to protect a legitimate interest of ACE. For instance, marketing activities and relationship management. We will always weigh up the interests first. Do you disagree with the use of your data on the basis of a legitimate interest? Then you can object to this.

What is meant by processing personal data?

‘Processing’ means recording, organising, modifying, storing, retrieving, using, searching, providing by means of transmission, dissemination or any other form of making available, bringing together, linking as well as blocking, erasing and destroying personal data.

What personal data do we process?

ACE may process the following personal data of website visitors, job seekers, candidates and business associates:

Website visitors

  • Data relating to the device you use to visit our website, such as IP address;
  • Which pages you have visited;
  • Data voluntarily entered or submitted on our website via the contact form.

Job seeker or candidate

  • Data (Name, first names, address, postcode and place of residence, (mobile) phone number, e-mail address, languages);
  • Date of birth/age, gender, nationality
  • Curriculum Vitae (CV), information on education, internships, courses and work experience.
  • All data that job seekers/candidates themselves share via their cover letter, CV or their contact with ACE (including passport photograph, additional activities, hobbies).
  • Additional data regarding availability and/or notice period, salary indication
  • Other data that is or may be important in the context of assessing the candidate’s suitability (including references, certificates, VOG).
  • Links from social media accounts and other communications

Business associates

ACE processes personal data of individuals working for companies with whom business is conducted, such as employees of clients and suppliers. This is within the framework of marketing, relationship management and customer contact. ACE can process the following personal data of business associates:

  • Business contact details;
  • Personal data that you provide during meetings.

With whom do we share your personal data?

ACE only shares data based on the need-to-know principle or in order to compete in tender procedures.

External service providers (processors)
For the purpose of providing certain services, ACE may engage the services of other parties. In doing so, ACE remains responsible for the processing of personal data. 

ACE uses the following service providers:

  • For sending newsletters via the CRM platform: Simplicate;
  • For the application process, we use the Recruitee tool, in which we collect the aforementioned applicant data. Through that tool, the data is stored in Recruitee’s database;
  • For optimising and improving the website, ACE uses the services of Google.

Third parties
ACE will not share your personal data with or otherwise make them available to third parties at home or abroad, unless you have given permission, there is a legitimate legitimate interest with a view to providing services, or there is a legal obligation to do so. However, ACE does retain the right to disclose certain applicant data to third parties, for example to competent (investigative) authorities

Do we process personal data abroad?

ACE prefers to work with parties based in the Netherlands and the European Union. Only in rare cases will personal data be shared with parties outside the European Union and only if appropriate protection measures are in place.

How long do we store your data?

ACE does not retain personal data longer than necessary for the purposes for which the data was obtained and is further processed unless the law requires the data to be retained for a longer period of time. The retention period used by ACE may vary per purpose and also depends on the nature of the data. At the end of the retention period, your personal data will be deleted or anonymised in such a way that they can no longer be traced back to you.

How does ACE ensure careful handling of personal data?

ACE does not record more personal data than necessary. In addition, ACE takes the necessary technical and organisational measures to protect your personal data against loss and unlawful use. This includes firewalls, encryption and secure servers

ACE employees and any third parties who may become aware of the data recorded by ACE, are obliged to maintain the confidentiality of these data. Only authorised personnel may view and edit data. They may also only do so to the extent necessary for the proper execution of the work. We ensure that physical and electronic data is handled with care. ACE is continuously investing in employees’ knowledge and awareness regarding your privacy. 

What are your rights?

You have various privacy rights when we process personal data about you. If you would like to exercise these rights, you can submit your request via

Access and transferability

You may ask us what personal data we process about you and to receive the data digitally to pass on to another controller.


You can ask us to make changes and/or improvements to your personal data.

Restriction of processing 

Under certain conditions, you have the right to restrict the use of your personal data. If we process your personal data based on a legal obligation or the execution of the agreement, we may reject your request for restriction.


You have the right to object to the processing of your personal data by ACE. This is not possible for every processing. Certain personal data is processed, for example, because ACE is legally obliged to do so. 


Under certain conditions, you have the right to ask us to have your personal data erased. If we process your personal data, based on a legal obligation or the execution of the agreement, we may reject (part of) your request to erase.

Withdrawal of consent

If ACE processes your personal data based on consent, you have the right to withdraw that consent. The withdrawal of consent does not have a retroactive effect; therefore, processing that has already been done is legitimate. 

Questions, comments or complaints

If you have any questions, comments or complaints about this Privacy Statement or the way we handle your personal data, please contact us via

We will respond to your request within one month. Do we need more time? Then we will let you know and why more time is needed.

For more information or complaints, you can also contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

This Privacy Statement was last updated in October 2023.