Privacy statement

This Privacy Statement was most recently reviewed in October 2026.

If you would like to read the privacy statement in a language other than English, please contact privacy@tmc.nl so we may provide you with a translation.

About Sentinel

Sentinel, a business cell of TMC Science & Technology NV (the Controller), and part of Titan Topco BV's group companies (jointly referred to as the "TMC Group"), provides high-quality strategy and innovation consultancy services. Sentinel supports their clients by connecting engineering, business and finance expertise, including services related to intellectual property, innovation strategy, technology landscaping, product roadmaps, funding and investment support, and the assessment of the strategic and business viability of engineering projects.

In order to do this, we collect and process personal data. This privacy statement explains which personal data we collect and how it is processed, stored and secured, what your rights are and how to exercise your rights.

What is personal data?

As defined in Art. 4(1) GDPR, personal data is any information related to an identified or identifiable natural person.

This includes objective and subjective information of a person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should also be considered to be information on an identifiable natural person, as described in Recital 26 of the GDPR.

Above all, in accordance with Art. 9 GDPR, special categories of personal data are highly sensitive and may create risks for data subjects, so they are subject to a higher level of protection. These data include biometric, genetic and health data, as well as personal data revealing ethnic or racial origin, religious or ideological convictions, political opinions, and trade union membership.

According to Recital 26 GDPR, the principles of data protection do not apply to anonymous information, namely information that does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is no longer identifiable.

Why does Sentinel collect your personal data?

Sentinel processes personal data for the following purposes:

• Offering diverse consultancy services;
• Concluding and carrying out agreements (e.g., contracts of employment or agreements with clients and suppliers);
• Communication objectives (newsletters, cookies on the website, events, etc.);
• Complying with legal obligations;
• Improving our services to our employees, our customers, and visitors of our website;
• Handling and responding to inquiries submitted through Sentinel's contact channels.

Please read the appendix of this privacy statement to find when we process data for these purposes, what data we collect, and how we collect, store, use and dispose of your data.

What are cookies?

Cookies are small information files that can be automatically stored on or read out from the device (including a PC, tablet or smartphone) of the website's visitor, while visiting a website. This is done through the web browser on the device. Sentinel uses cookies for the following purposes:

• To enable the functionality of our website (technical and functional cookies);
• To generate overall statistics and gain insights into the use of our website by the public, to improve and optimize our website and services (analytical cookies);

For more information about the cookies that we collect and about changing and/or removing them, see our Cookie Statement.

What are your rights to your personal data processed by Sentinel?

Sentinel respects the rights of data subjects with regard to their personal data. Some rights can be exercised at all times; other rights can be exercised under certain conditions only. For example, we cannot grant the request of a data subject to delete their personal data if there is a legal obligation to retain that personal data for a certain period of time.

Data subjects can exercise the following rights:

• Right of access to personal data;
• Right of rectification of personal data;
• Right to erasure of personal data;
• Right to restrictions on processing of personal data;
• Right to transfer of own personal data;
• Right to object to processing activities where we rely on legitimate interest;
• Right to withdraw your consent at any time;
• Right to submit a complaint to the competent supervisory authority;
• Right to not be subject to solely automated decisions significantly affecting you.

The aforementioned rights can only be exercised in respect of the personal data of the data subject and are, in some cases, subject to the basis on which they were collected. Data subjects are not allowed to exercise these rights in respect of the personal data of others. Sentinel may request data subjects to provide additional identification in this regard.

The aforementioned rights can be exercised by the data subjects by contacting privacy@tmc.nl.

You may also contact the Sentinel Privacy Officer using the contact details in point 8.1 of this privacy statement.

How does Sentinel protect your personal data?

We take technical and organizational measures to protect the privacy of those involved and the confidentiality of their personal data:

Information security

Sentinel data can be divided into 4 categories: Confidential (HRM confidential, Management), Private limited (Sentinel Staff), Private internal (Staff & Employeneurs) and Public. Highly sensitive/confidential data is mainly stored in the ERP system or in special confidential channels of Microsoft Teams. Internal information is stored in Microsoft365. Candidate data (applications for our vacancies) is stored in our Applicant Tracking System (Trackr), which is built on Salesforce, and is also temporarily stored on Carv, a generative AI recruitment assistant, used to support recruiters with interview preparation and summarizing, note-taking and transcription; candidate communication; candidate-vacancy matching and screening; and the accurate completion of candidate records in our applicant tracking system. Carv never operates without human supervision and does not make autonomous recruitment decisions – recruitment decisions are only taken by our recruiters. It is mainly public data that is stored on the website. Extra care is taken in securing sensitive information, such as personal data and customer data.

Infrastructure and devices

The management, maintenance and monitoring of the technical infrastructure is outsourced to a company that is certified for IT security (e.g., ISO 27001) and that has taken sufficient measures, such as physical access security, firewalls, VPN, continuity facilities and monitoring tools, to ensure infrastructure security. All TMC offices (including TMC Science & Technology NV and, by extension, Sentinel) have secured networks with advanced firewalls and active monitoring to safeguard security and continuity. All managed clients have antivirus/antimalware, up-to-date and supported operating systems and disk encryption that is centrally managed and monitored.

Applications

All Sentinel applications are stored in a secured public cloud environment or in an Azure/Office 365 tenant. Authentication takes place through Sentinel's central user management, including Multi-Factor Authentication for all internal staff. Authorization is carried out via security groups for each function group. User management is an automated process, based on HR administration, and it is checked periodically. Sentinel data is securely stored on encrypted disks within the EEA (European Economic Area). Logging is activated as much as possible for each application, both for detective and reactive purposes.

What you can do to help us:

You can contribute to the protection of your personal data by, for example, being careful when disclosing personal data when you respond to jobs and messages posted on social media by Sentinel and companies of the TMC group. The information that is posted there may be public.

When does Sentinel share personal data?

When we share data, we comply with legislation and only provide the necessary information.

Sharing within Sentinel

Sentinel employees may be granted access to your personal data for executing the purposes described in this Statement. All employees are bound by confidentiality obligations and may only access personal data where necessary for their role.

Sharing with clients

Personal data of candidates and employees is shared with clients and prospects, for example, when introducing candidates and employees to existing and potential clients and/or enabling an employment relationship with these clients.

When Sentinel proposes a candidate or employee for an assignment with a client, we may share personal data such as the candidate's or employee's name, professional profile, relevant work experience, education, skills, certifications, and place of residence. This data is shared on the basis of a CV compiled by the candidate or employee together with their account manager.

Clients may also independently collect or process personal data of Sentinel employees or candidates in the context of their own onboarding, security screening, or site access procedures. In such cases, the client acts as an independent controller and Sentinel is not responsible for that processing. We encourage you to review the client's own privacy notice in such situations.

Sharing with Managed Service Providers (MSPs)

In some cases, Sentinel works with Managed Service Providers (MSPs) engaged by our clients. Personal data of candidates and employees may be shared with MSPs to facilitate the placement process and administrative requirements of the client. Depending on the engagement, MSPs act either as processors on behalf of the client or as independent controllers, and process this data in accordance with their own or the client's privacy policies. Sentinel ensures that appropriate contractual safeguards are in place.

Sharing with processors

If we share personal data with processors (parties who process personal data on behalf of Sentinel, such as IT infrastructure or software suppliers, but also parties that provide training courses) or other responsible parties, we ensure that there is either a processing agreement or other contractual provisions in place to guarantee secure processing of the personal data. We can carry out checks on this.

Sharing with other responsible parties

If we share personal data with parties that provide services and that are responsible in this context for determining the purpose and means of processing this personal data (e.g., a pension fund or the Tax and Customs Administration), we will check whether there are clear agreements on the careful handling of these data or make such agreements.

Sharing due to a legal obligation

We only provide personal data at the request of the police and judiciary if there is a legal obligation to do so.

Sharing outside the European Economic Area (EEA)

If personal data is transferred to our group companies based in countries outside the European Economic Area (EEA), we will have entered into appropriate agreements with the entities and carried out relevant Transfer Impact Assessments (TIAs) for supporting the transfer.

In the context of client assignments, personal data of candidates and employees may also be transferred internationally to clients or their affiliates located outside the EEA, for example when a client operates globally or when an assignment involves cross-border activities. In such cases, Sentinel ensures that appropriate transfer mechanisms are in place, including Standard Contractual Clauses (SCCs) where required.

If we transfer personal data to external parties based outside the EEA where there is no adequate level of protection, we will continue to monitor the processing of personal data in addition to the agreements made.

Notification of a (suspected) security breach

In the event of a suspected or confirmed breach of personal data security, data subjects are requested to inform Sentinel as soon as possible via helpdesk@tmc.nl stating 'security data breach' in the email's subject line.

Contact

If you have any questions or wish to submit a complaint about the use of your personal data, please contact us using the contact details below.

We will address any questions or complaints internally and communicate this further with you. If you feel like we are not helping you in the correct manner, you have the right to file a complaint against our processing of your personal data with the national supervisory authority responsible for the protection of personal data. For Belgium, this is the Gegevensbeschermingsautoriteit.

Contact details Sentinel:

TMC Science & Technology NV
Da Vincilaan 11
1930 Zaventem
Belgium
Company number: BE0544.895.718

Contact details Privacy Officer:

E-mail address: privacy@tmc.nl
Telephone number: +31(0)88 862 2000

Contact details Data Protection Officer:

Email address: DPO@tmc.nl

Amendments to the privacy statement

We may amend this privacy statement. If substantial changes are made to the privacy statement, this will be communicated on the tmc-sentinel.com website.

Appendix

Overview of the purposes of processing, types of personal data processed, and the personal data life cycle of collecting, storing, using and disposing.

Using Sentinel's website

Purpose of processing:

• To send us a message;
• To improve the services that Sentinel provides.

Personal data processed and their life cycle:

• To send us a message.
• Improving our services: cookies and similar technical data that are strictly necessary and/or voluntarily agreed to.

Personal data life cycle:

You can send us a message through e-mail, where we will process your e-mail address, the subject of the message, and any further personal data and information provided voluntarily by you in your message. We retain this data for as long as necessary to address the specific requests or questions made by the data subject, and related information may be shared with the relevant Sentinel personnel for this purpose.

When a data subject visits our website for the first time, the site displays a message with an explanation about the cookies we use. We will ask for consent to place the cookies, when we are required to do so. Upon agreement to the use of cookies, these cookies will be placed on the device of the data subject. Our cookie statement gives an overview of the types, purposes and retention periods for the cookies. The consent for cookies can be withdrawn by removing the cookies through the device's browser setting or the “Cookie settings” section in the webpage.

Recruitment and employment agreement & related obligations at Sentinel

Recruitment activities and the management of employment agreements within Sentinel happen within the scope of the TMC group's data protection operations. To understand better how the TMC group processes your personal data for recruitment and employment management purposes, you can find more information on the Privacy Statement at TMC's webpage (https://www.themembercompany.com/). For additional information about how we process your personal data, you can contact privacy@tmc.nl.

Possible data collection by clients

See §7.2 (Sharing with clients) — clients may independently collect personal data as independent controllers in the context of their own onboarding, screening or site access procedures, and are responsible for that processing.

With regard to other internal purposes

Purpose of processing:

• To ensure operational safety;
• To generate management information;
• To comply with legislation to which Sentinel is subject;
• To enable audits to take place;
• To maintain relationships with stakeholders, including through invitations, events, greetings, and other business relationship communications.

Personal data processed:

With respect to the processing of personal data for these other internal purposes of Sentinel, the basic principle is that the use of directly identifiable information is limited to the minimum and that data is anonymized where possible.

Personal data life cycle:

The personal data is given to Sentinel by the data subject or created in cooperation with them, for the execution of the respective purposes. Sentinel does not process any sensitive data of a data subject at this stage. We store the personal data in our HRM, CRM and other systems within our secured IT environment. We process the data on the legal ground of execution of an agreement, legitimate interest, and consent. We may legally share necessary personal data with third parties. Following the termination of an employment agreement, we will retain the data used in this processing activity for an additional period determined by local legal obligations applicable to the respective data subject and Sentinel employer. We will also retain personal data used in this processing activity for a finite period determined by local financial regulations.

To inform clients and potential clients about Sentinel's services and to be able to submit offers

Purpose of processing:

• To acquire new clients;
• To be able to offer services to new clients.

Personal data processed:

• Acquisition: contact details of representatives of clients;
• Insight into the assignment: description of the company and its activities, culture, content of the assignment, and desired profiles;
• Offering services: contact details of representatives of potential clients, information about the sector in which the client operates;
• Offering/providing information about services: contact details of representatives of potential new clients, information about the sector in which these clients operate.

Personal data life cycle:

The retention period for this processing activity will be determined by retention schedule and local legal requirements, taking into account the purpose of the client or prospect relationship, the status of the commercial opportunity, any contractual or pre-contractual obligations, applicable limitation periods, financial and tax retention requirements, and whether the personal data remains necessary for maintaining a relevant business relationship. Where personal data is no longer necessary for these purposes, it will be deleted or anonymised in accordance with Sentinel's retention procedures.

The personal data is given to Sentinel by the data subject or created through cooperation. Sentinel does not process any sensitive data of a data subject at this stage. We store the personal data in our CRM and other systems within our secured IT environment. We process the personal data on the legal ground of execution of an agreement. Applicable retention periods will be determined by Sentinel's retention schedule and local legal requirements, taking into account the purpose of the client or prospect relationship, the status of the commercial opportunity, any contractual or pre-contractual obligations, applicable limitation periods, financial and tax retention requirements, and whether the personal data remains necessary for maintaining a relevant business relationship.

Establishing and maintaining business relationships with suppliers

Purpose of processing:

• To conclude and implement agreements and/or to have them implemented;
• Communication.

Personal data processed:

• Concluding and implementing agreements: contact details: name, e-mail address, and telephone number;
• Communication: contact details: name, e-mail address, telephone number.

Personal data life cycle:

The personal data is given to Sentinel by the data subject or created through cooperation. Sentinel does not process any sensitive data of a data subject at this stage. We store the personal data in our CRM and other systems within our secured IT environment. We process the personal data on the legal ground of execution of an agreement.

Marketing

Purpose of processing:

• To send newsletters, event invitations and other marketing communications;
• To inform clients, prospects, candidates and other business contacts about Sentinel's services, activities and events;
• To measure the effectiveness of marketing communications and improve their relevance.

Personal data processed:

• Contact details: name, e-mail address, telephone number, company name and job title;
• Marketing preferences: communication preferences, newsletter subscriptions, event registrations and opt-in or opt-out choices;
• Interaction data: whether marketing communications are opened, clicked or otherwise interacted with, where this is technically available.

Personal data life cycle:

The personal data is given to Sentinel by the data subject, obtained through business interactions, or created through the data subject's interaction with Sentinel's marketing communications. Sentinel does not process sensitive data for marketing purposes. We store the personal data in our CRM, marketing and other systems within our secured IT environment. We will process personal data on the legal ground of consent for as long as you remain subscribed to marketing communications, and otherwise on the basis of Sentinel's legitimate interest to maintain business relationships and inform relevant contacts about Sentinel's services and activities. Data subjects may unsubscribe or object to marketing communications at any time.