Introduction
This privacy statement explains how ProQR Therapeutics N.V. processes your personal data during the job application procedure. If you are offered a job, additional privacy information will be provided with the employment agreement and employee manual.

Personal Data Collected

1. Contact Information: Name, address, email address, telephone number.
2. Qualifications: Details of qualifications, skills, experience, and employment history.
3. Health Data: Special categories of personal data concerning health (e.g., disability or pregnancy) disclosed by you for support during the interview.

Collection Methods

• Directly from You: Through contact details, resumes, references (optional), email, or online submission forms, and during interviews.
• Third Parties: From references you provide, recruitment agencies, and professional social media and recruitment platforms.

Purposes and Legitimate Basis for Processing

• Communication: Contact information is used to communicate throughout the application process, based on legitimate interest and preparation for potential employment contracts.
• Assessment: Information regarding qualifications is processed to assess fit for the vacancy, based on legitimate interest.
• References: Optional references are processed to better assess applications, based on legitimate interest.
• Evaluation and Improvement: Aggregated data on contact information and qualifications is used to improve recruitment procedures, based on legitimate interest.
• Support for Health Needs: Health data is processed to make necessary arrangements during interviews, based on legal and ethical obligations.

Recipients of Personal Data

• Internal: HR team, interviewers from relevant departments, and the hiring committee.
• External: Providers of job application software, recruitment agencies (if used), professional social media platforms (if used), and references provided by you.

Data Retention

• Application Data: Stored for a maximum of four weeks post-application procedure, or up to a year with your permission.
• Health Data: Retained only as long as necessary for interview arrangements.

Data Subject Rights

• Right to Access: Request information about your personal data processed by ProQR.
• Right to Rectification: Correct inaccurate or incomplete personal data.
• Right to Restriction of Processing: Request restriction of data processing in specific cases.
• Right to Be Forgotten: Request deletion of personal data under certain conditions.
• Right to Data Portability: Receive personal data in a structured, machine-readable format.
• Right to Object: Object to data processing based on legitimate interests.
• Right to Lodge a Complaint:
• EU Residents: Contact your national data protection authority. You can find their contact details here.
• UK Residents: Lodge a complaint with the Information Commissioner’s Office here.
• Other Countries: Contact the data protection authority in your country.

Where Can You Turn with Comments or Questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments, or concerns about how we handle your personal data, you can reach us by sending an email to dpo@proqr.com.

Automated Decision-Making
ProQR does not use fully automated decision-making technologies.

Technical and Organizational Measures
Your personal data is securely stored in a job applicant tracking system. Access is restricted to HR and relevant employees. Internal policies prevent sharing or keeping resumes by email, and printed materials are securely destroyed.

International Transfers
While we strive to process your personal data within the EU/EEA, some of our service providers, such as providers of job application software, recruitment agencies (if used), professional social media platforms (if used), and references provided by you, are based outside the EU/EEA. This means your personal data may be transferred outside the EU/EEA during the application process.

In such cases, we ensure that, where legally required, GDPR-recognized safeguards are in place, such as the EU Commission’s adequacy decisions or standard contractual clauses, to protect your data. For example, we rely on the EU-US Data Privacy Framework and the EU Commission’s adequacy decision for the UK. Additionally, we implement appropriate technical and organizational safeguards to protect your personal data.

If you want more information about the transfer of your personal data outside the EU/EEA, please contact us using the details provided in our privacy policy.

Updates to This Privacy Policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to comply with applicable data protection laws. We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.

Contact Information
For any concerns or to exercise your rights, contact our Data Protection Officer at dpo@ProQR.com.