Privacy policy

Any collection, use, storage, deletion or other use (hereinafter “processing”) of data is solely for the purpose of providing our services. Our services have been designed with the aim of using as little personal data as possible. In this context, “personal data” (hereinafter also referred to as “data”) shall be understood to mean all individual details about personal or factual circumstances of an identified or identifiable natural person (so-called “data subject”).

The following statements on data protection describe what types of personal data are processed when you access our website, what happens to this personal data and how you can object to data processing if necessary.

 

1. general information about data processing on this website

 

1.1 Responsible person

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is

consultingheads GmbH

Address:
Mittelstraße 11
40789 Monheim am Rhein

Phone:
+49 221 572730-0

E-Mail:
[email protected]

Homepage:
https://consultingheads.com/

 

1.2 Data protection officer

The data protection officer is:

Christian Scholtz from WS Datenschutz GmbH

If you have any questions about data protection, you can contact WS Datenschutz GmbH at the following e-mail address: [email protected]

WS Data Protection GmbH

Dircksenstrasse 51

D-10178 Berlin

https://webersohnundscholtz.de

 

1.3 Protection of your data

We have taken technical and organizational measures to ensure that the provisions of the GDPR are observed both by us and by external service providers working for us.

When we work with other companies, such as email and server providers, to deliver our services, we do so only after an extensive selection process. In this selection process, each individual service provider is carefully selected for its suitability in connection with technical and organizational capabilities in data protection. This selection procedure shall be documented in writing and a contract shall be drawn up in accordance with. Art. 28 par. 3 GDPR on the processing of personal data on behalf (AV contract) is concluded only if it complies with the requirements of Art. 28 GDPR.

Your data will be stored on specially protected servers. Access to it is only possible for a few specially authorized persons.

Our website is SSL/TLS encrypted, which you can recognize by the “https://” at the beginning of the URL. Insofar as personal data is involved in e-mail communication, e-mails are sent from our side in encrypted form. We also use the integrated SSL certificate for this.

 

1.4 Deletion of personal data

We process the personal data only as long as it is necessary. As soon as the purpose of the data processing has been fulfilled, blocking and deletion take place in accordance with the standards of the deletion concept here, unless legal regulations prevent deletion.

 

2. data processing on this website and creation of log files

 

2.1 Description and scope of data processing

When you visit our website, our web servers temporarily store each access in a log file. The following personal data is collected and stored until automated deletion:

• Access and error log data

In addition to this personal data, other personal data may be collected by us and our partners, more on this below.

In order to provide our Internet offer, we use the services of the hosting provider Raidboxes GmbH, Hafenstraße 32, 48153 Münster.

For more information, please refer to the privacy policy of Raidboxes GmbH at https://raidboxes.io/legal/privacy/.

 

2.2 Legal basis for data processing

The processing of this data is based on Art. 6 para. 1 S.1 lit. f) GDPR. Our legitimate interest is based on making our website accessible to you.

2.3 Purpose of the data processing

The data processing is carried out for the purpose of enabling the use of the website (connection establishment). It is used for system security, technical administration of the network infrastructure and optimization of the Internet offering. The IP address is only evaluated in the event of attacks on our network infrastructure or the network infrastructure of our Internet provider.

 

2.4 Duration of data storage

The personal data will be deleted as soon as they are no longer required for the above-mentioned purposes. This is the case when you close the website. Our hosting provider may use the data for statistical surveys. However, the data is anonymized for this purpose. A deletion of the data takes place at our hosting provider after 7 days.

 

2.5 Possibility of elimination by the data subject

The website can only be displayed if the described data is processed. If you object to the further processing of the data, please contact our data protection officer or the hosting provider at [email protected].

 

3. use of cookies

 

3.1 Description and scope of data processing

Our website uses cookies. These are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive, assigned to the browser you are using, and through which certain information flows to us or to the entity that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They are used by us to enable you to log in and to analyze the use of our website in anonymized or pseudonymized form and to present you with interesting offers on this website. In this way, various data can be transmitted:

• Frequency of website visits
• Which functions of the website are used by you
• Search terms used
• Your cookie setting

When you access the website, a cookie banner informs you about the use of cookies and refers you to the privacy policy.

Notice regarding data processing in the USA by Google:

By clicking on “Agree to all”, you agree to the terms and conditions of this agreement. Art. 6 par. 1 p. 1 lit. a) GDPR that your data will be processed in the USA. According to the ECJ, the data protection standard in the U.S. is inadequate and there is a risk that your data will be processed by the U.S. authorities for control and monitoring purposes, possibly also without any legal remedy. If you consent only to the setting of essential cookies, the transfer does not take place. Consent given can be revoked at any time.

 

3.2 Legal basis for data processing

The legal basis for the processing of data through cookies that do not solely serve the functionality of our website is Art. 6 para. 1 p. 1 lit. a) GDPR.

The legal basis for data processing for cookies that serve solely the functionality of this website is Art. 6 para. 1 S.1 lit. f) GDPR.

 

3.3 Purpose of the data processing

Our legitimate interest results from the guarantee of a smooth connection and a comfortable use of our website as well as for reasons of evaluation of system security and stability. The data processing also takes place in order to enable a statistical evaluation of the website usage.

 

3.4 Duration of data storage

There are two types of cookies. Both are used on this website:

• Transient cookies (for this a)
• Persistent cookies (for this b)

a) Transient cookies, they are automatically deleted when you close the browser. These include, in particular, session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

b) Persistent cookies, these are automatically deleted after a predefined duration, which may differ depending on the cookie.

The data will only be stored for as long as is necessary for the review, unless statutory provisions require the data to be stored for longer. Borlaps will delete your consent after 6 months.

 

3.5 Possibility of elimination by the data subject

You have the possibility at any time to revoke your consent to data processing by cookies that are not solely used for the functionality of the website. In addition, we only set cookies after you have consented to the setting of cookies when you access the site. In this way, you can prevent data processing via cookies on our website.

You can also delete the cookies in the security settings of your browser at any time. Please note that you may not be able to use all the features of this website. The setting of cookies can also be prevented at any time by making the appropriate settings in your Internet browser.

You can revoke the consent given via our Borlabs consent banner by deleting the corresponding cookie called “borlaps-cookie”.

 

3.6 Borlabs

Borlabs serves the practical implementation of the GDPR and other data protection related law regarding the use of cookies on our website and the integration of analytics tools by means of consent. If you give your consent via the cookie banner, the following data will be processed:

• Your IP address
• Details of your consent
• URL of the consent web page
• Date and time of consent
• Date and time of the last page access

The processing of this data is based on Art. 6 para. 1 S.1 lit. c) GDPR.

The data processing is carried out by: Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany.

For more information about data processing, please visit: https://de.borlabs.io/datenschutz/

 

3.7 CCIM

CCIM is integrated into the website as a cookie consent solution and is used for implementation in compliance with data protection law. CCIM manages your consent, which you enter via the consent banner. The following data is processed for this purpose:

• Your IP address

The processing of this data is based on Art. 6 para. 1 sentence 1 lit.c) GDPR.

The data is processed locally on the devices. There is no transfer to third countries.

Further information on data processing can be found at: https://www.ccm19.de/datenschutzerklaerung.html

4. contact

 

4.1 Description and scope of data processing

Through our website it is possible to contact us via e-mail to [email protected] or a contact form. For this purpose, various data are required to respond to the request, which are automatically stored for processing. The following data is collected as a minimum (marked as mandatory field) in the contact form:

Find contact form consultinghead:

• First name
• Last name
• Phone
• E-mail address

You can also voluntarily provide the following information:

• Company
• Employment relationship
• Message

Contact form consultinghead:

• Search query (dropdown)
• First name
• Last name
• Mobile number
• Email address
• Profile Upload/ Project List

You can also voluntarily provide the following information:

• personal elevator pitch
• LinkedIn profile address

The data will not be passed on to third parties.

 

4.2 Legal basis for data processing

The legal basis used here is Art. 6 para. 1 S.1 lit. b) GDPR.

 

4.3 Purpose of the data processing

We process your data exclusively to handle your contact request.

 

4.4 Duration of data storage

Your data will be deleted by us as soon as the purpose of the data processing has been fulfilled, predominantly immediately after the request has been answered. In rare cases, however, we may retain your data for a longer period of time. This may result from legal, regulatory or contractual obligations.

 

4.5 Possibility of elimination by the data subject

You can contact us at any time and object to further processing of your data. In this case, unfortunately, we can not continue communication with you. All personal data processed by us in the course of contacting you will be deleted in this case, unless this deletion conflicts with legal obligations to retain your data.

 

5. data processing in the context of applications

 

5.1 Description and scope of data processing

It is possible to apply via our website using an application tool Vincere(https://www.vincere.io/?lang=de) and via e-mail to [email protected]. For this purpose, personal data is processed and stored for further processing for the respective application procedure.

 

5.2 Legal basis for data processing

The legal bases for the data processing are Art. 88 DSGVO and § 26 BDSG.

 

5.3 Purpose of the data processing

We process your data exclusively for the purpose of carrying out the application procedure.

 

5.4 Duration of data storage

If the application should lead to the commencement of an employment relationship, the personal data will be stored accordingly in compliance with the statutory provisions. If the application is not considered when selecting a potential candidate, it will be deleted in accordance with the rules of the deletion concept here, taking into account the provisions of the AGG, in particular the existing burden of proof under Section 22 AGG.

This does not apply if legal provisions prevent deletion or if you have given your consent to longer storage. In this case, the further storage of your personal data is based on Art. 6 para. 1 p. 1 lit. c) or lit. a) GDPR.

 

5.5 Possibility of elimination by the data subject

You can contact us at any time and object to further processing of your data. All personal data processed by us in the course of the application process will be deleted in this case, unless deletion is contrary to mandatory statutory provisions

 

5.6 Vincere.io

 

5.6.1 Description and scope of data processing

For our application portal we use the recruiting software “Vincere.io”. The data processing is carried out by: HiringBoss Holdings Pte Ltd, of 120 Robinson Road, #15-01 068193, Singapore. We have integrated this service provider via iframe on our website.

The following data may be collected for us in this context by vincere.io:

• Username
• Photo
• Biographical information, such as your profession, social media profiles, company name, and areas of expertise.

For more information, please see the following link to Vincere.io’s privacy policy: https://www.vincere.io/privacy-archived20jan21?lang=de

 

5.6.2 Legal basis for data processing

The legal basis for the use of Vincere.io is our legitimate interest in providing an application portal pursuant to Art. 6 para. 1 p. 1 lit. f) GDPR.

 

5.6.3 Purpose of data processing

The purpose of data processing is to optimize our application management.

 

5.6.4 Duration of data storage

The data will be deleted as soon as the purpose of the data processing has been achieved and no legal, contractual or official retention periods prevent deletion.

 

5.6.5 Possibility of elimination by the data subject

You have the possibility to object to the data processing at any time by notifying our data protection officer. If you have any questions about Vincere.io’s privacy practices, you may contact Vincere.io at any time at the following email address: [email protected].

If you do not wish to have your data processed by Vincere.io and do not wish to use our application portal, you also have the option of sending your application directly to us by e-mail to [email protected].

5.7 Call recording

5.7.1 Description and scope of data processing

If you contact us by telephone or take part in an online meeting, the conversation will be recorded with your consent and then transcribed. This recording is used to store the meeting notes in our CRM system Vincere.

We use the tool fireflies.ai to record and transcribe online meetings. The data processing is carried out by: Fireflies.AI Corp, 5424 Sunol Blvd , Ste 10-531 Pleasanton, CA 94566, USA.

You can find additional information on data protection at: https://fireflies.ai/privacy_policy.pdf

We also use the Comdesk tool to record and transcribe telephone calls. The data processing is carried out by: Comdesk GmbH, Neuenkampsweg 4, 25337 Kölln-Reisiek, Germany.

You can find additional information on data protection at: https://www.comdesk.de/datenschutz/

5.7.2 Legal basis for data processing

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 p. 1 lit. a) GDPR.

5.7.3 Purpose of data processing

We document the content of telephone calls and online meetings as part of our business activities. Recording and automatic transcription are intended to make this easier for our employees. The recording also serves the purpose of quality assurance.

5.7.4 Duration of data processing

The recording of the call is stored in Fireflies or Inopla / Comdesk and automatically deleted after 3 months or immediately if consent is withdrawn. The transcription created is transferred to the Vincere CRM system and stored there (for a specific purpose) in accordance with the applicable deletion periods for call notes.

5.7.5 Possibility of removal by the person concerned

You have the option to withdraw your consent to data processing at any time. To do so, please contact [email protected].

If you have any questions about data protection at Fireflies.ai, you can contact us by e-mail at [email protected].

If you have any questions about data protection at Comdesk GmbH, you can contact us by e-mail at [email protected].

5.8 Microsoft Azure

5.8.1 Description and scope of data processing

We use Azure to host internal AI agents, which contains a full copy of the candidate database (from Vincere.io). These data centers meet various certifications, including ISO 27001, and are operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The following data in particular is processed as part of data processing

• Your name
• Curriculum vitae
• Contact details
• Professional background

The data centers are located in the European Union and in the United States of America. Only the data centers within the EU are used, whereby the controller can control access himself.

Privacy policy: https://privacy.microsoft.com/de-de/privacystatement

 

5.8.2 Legal basis for data processing

The legal basis for data processing in accordance with the above paragraphs is Art. 6 para. 1 lit. f) GDPR. Our interest in data processing is in particular to ensure the integrity of the applications by providing a copy of the applicant data.

5.8.3 Purpose of data processing

The purpose of data processing is to enable the AI agent to obtain a copy of the candidate database in order to ensure further processing.

5.8.4 Duration of data storage

The data will be deleted if the purpose of the data storage has been fulfilled and no contractual, official or legal regulations prevent deletion. The copies created by the AI agent are strictly accessory to the originals during the deletion period.

5.8.5 Possibility of removal by the data subject

You have the possibility to object to the data processing at any time by notifying our data protection officer. If you have any questions about data protection at Microsoft Azure, you can contact Microsoft at any time.

If you do not wish to have your data processed by Microsoft Azure and do not wish to use our application portal, you also have the option of sending your application directly to us by e-mail to [email protected].

6. registration on the website

 

6.1 Description and scope of data processing

You can register on our website. This requires that you enter personal data in the registration mask. The following minimum data is collected for this purpose:

• First name
• Last name
• E-mail address
• Password

The data you provide in the registration mask will be used exclusively for processing and will not be passed on to third parties as a matter of principle.

 

6.2 Legal basis for data processing

If you provide personal data that belong to the mandatory field input masks, the data processing is based on Art. 6 para. 1 p.1 lit b) GDPR. If you also enter personal data in the other (optional) input field masks, the data processing is based on Art. 6 para. 1 S.1 lit. a) GDPR.

 

6.3 Purpose of the data processing

We process your data solely for the purpose of completing your registration and maintaining your website account with us.

 

6.4 Duration of data storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case if you close your account with us and no legal or official retention periods prevent deletion. You also have the option to request deletion by pressing the “Request deletion of data” field in your profile. In this case, we will receive a notice that deletion has been requested and delete your profile.

 

6.5 Possibility of elimination by the data subject

Both during and after registration, you are free to change, correct or delete your personal data.

 

6.6 Social login using social media

 

6.6.1 Description of data processing

We offer you the possibility to register by means of your

• LinkedIn accounts
• PrepLounge accounts

register and log in to our website (social login).

In this case, an additional registration on this website is not required. Rather, the user account of your social network used for login is linked to the customer account on our website, so that you can authenticate yourself with your social media user account to the customer account on our website and log in there. The advantage for you is that you do not have to remember a new password for your customer account on our website.

By linking, we automatically receive the following information from LinkedIn Ireland or PrepLounge GmbH:

LinkedIn:

• E-mail address
• Social ID
• Name
• Profile picture
• Maiden name
• Link to your public profile

The enumeration can be found at: https://docs.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin?context=linkedin/consumer/context

PrepLounge:

• First name
• Education level
• Gender
• Major
• Industry interests
• Study and university

For more information on the respective social media login, the transmitted data and the privacy settings of your social media account, please refer to the respective privacy notices of:

• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• PrepLounge: https://www.preplounge.com/de/cookies-and-privacy-settings-and-policy?tab=privacysettings

 

6.6.2 Legal basis for data processing

In the case of the transmission of the first and last name as well as the e-mail address, the data processing is based on Art. 6 para. 1 p.1 lit b) GDPR. You voluntarily provide us with any additional information. Therefore, the data processing in this case is based on Art. 6 para. 1 S.1 lit. a) GDPR.

 

6.6.3 Purpose of data processing

The Social Login makes it easier for you to use our registration function. It also provides us with information about the use of our website by social media users. We also use social media logins to make our website better known overall

 

6.6.4 Duration of data storage

The social login data will be stored and used as described until a revocation is declared.

 

6.6.5 Possibility of elimination by the data subject

You can prevent this data processing by using the regular registration process. Both during and after registration, the person concerned is free to change, correct or delete the personal data. In addition, if the data processing is based on consent, you have the option to revoke your consent to the data processing, cf. Art. 7 DSGVO. A revocation takes effect from the time it is issued. It develops an effect for the future. You can revoke the consent at any time. This can be done by telephone, by mail, by e-mail or by other means to us. Further settings may be possible within the profile settings of your social media account.

 

7. newsletter

 

7.1 Description and scope of data processing

We offer on our website the possibility to subscribe to our newsletter. When ordering the newsletter, you will be asked to provide personal data for processing. This is the data that is requested in the newsletter input mask. Input fields marked with a “*” are mandatory fields:

• First name
• Last name
• E-mail address

These mandatory fields are necessary to send you the newsletter.

The newsletter is sent by e-mail. You will receive the newsletter only after registration. In order to meet the requirements of the DSGVO, we use the so-called DOI procedure (“double opt-in”). If you register for our newsletter, you will receive a confirmation e-mail to the electronic mailbox specified in the input field. This email contains a confirmation link that you must click. After this procedure you have successfully registered for the newsletter. To carry out the procedure, the IP address, date and time of registration are stored. This in order to prevent abuses. As a matter of principle, the data is not passed on to third parties.

 

7.2 Legal basis for data processing

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 S.1 lit. a) GDPR.

 

7.3 Purpose of the data processing

The newsletter has the function of informing you at regular intervals about offers and news from us.

 

7.4 Duration of data storage

We only process your data for as long as this is necessary to fulfill the purpose and no legal or official retention obligations prevent deletion.

7.5 Possibility of elimination by the data subject

10.5 Hubspot

10.5.1 Description and scope of data processing

We use “HubSpot”, a platform for marketing, sales, customer management and customer service. The data processing is carried out by: HubSpot, Inc, 25 First Street Cambridge, MA 02141, USA.

HubSpot collects the data entered in the contact form as well as the day and time the email was opened and stores it in our software. Your data is stored on servers in the USA.

We use the service for analysis purposes and to evaluate the use of our website.

Note on data processing in the USA:

It is possible that your data will be processed by our service provider HubSpot in the USA. According to the ECJ, the data protection standard in the U.S. is inadequate and there is a risk that your data will be processed by the U.S. authorities for control and monitoring purposes, possibly also without any legal remedy.

HubSpot does not use the data and does not pass it on to third parties. We trust in the reliability and IT and data security of HubSpot. Further information on data protection at HubSpot can be found at https://legal.hubspot.com/de/terms-of-service.

10.5.2 Legal basis for data processing

The data processing of your data entered in the contact form by HubSpot is carried out in accordance with Art. 6 para. 1 p. 1 lit. b) GDPR. The data processing of the day and time of e-mail opening is based on our legitimate interest in accordance with Art. 6 para. 1 S.1 lit. f) GDPR on customer-friendly communication and acquisition.

The legal basis for data processing for analysis purposes is your consent in accordance with Art. 6 para. 1 p. 1 lit. a) GDPR.

10.5.3 Purpose of data processing

We use HubSpot as our service provider to ensure effective address management and to be able to contact you via a contact form.

We use HubSpot to effectively analyze user behavior on our website.

 

10.5.4 Duration of data storage

According to HubSpot, HubSpot only stores your personal data for as long as we use your personal data. HubSpot deletes your data when we delete you from our address file or delete our account with HubSpot after a period of 30 days.

10.5.5 Possibility of removal by the data subject

You have the option to revoke your consent to data processing at any time. You have the option to object to data processing at any time. To do so, please contact our data protection officer

 

11.1.4 Duration of data storage

Your data will only be stored as long as this is necessary to fulfill the purpose and no legal obligations to store your data prevent deletion.

11.1.4 Options for elimination by the data subject

You have the option to revoke your consent to data processing at any time. Please contact our data protection officer for this purpose. You can prevent Cloudflare from processing your data by disabling the execution of script code in your browser or installing a script blocker, but this may result in our website no longer being displayed correctly.

Privacy Policy for Our Social Media Presence

Joint Controllers for Social Media

consultingheads GmbH

Address: Mittelstraße 11
40789 Monheim am Rhein, Germany

Telephone: +49 221 572730-0

Email: [email protected]

Website: https://consultingheads.com

operates the following own presences on social media platforms:

Facebook: https://www.facebook.com/consultingheads
Instagram: https://www.instagram.com/consultingheads/
LinkedIn: https://www.linkedin.com/company/consultingheads/
XING: https://www.xing.com/pages/consultingheads

In doing so, we make use of the services of

Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA or Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”, “Instagram”)
LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland or LinkedIn Corporation, 1000 W. Maude Ave., Sunnyvale, California 94085, USA (“LinkedIn”)
XING SE, Dammtorstraße 30, 20354 Hamburg, Germany (“XING”).

Due to the ruling of the European Court of Justice of 05 June 2018 (available at http://curia.europa.eu/juris/document/document.jsf?text=&docid=202543&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=298398), operators of social media presences and the operators of the social media platforms themselves are considered joint controllers for data processing.

We would like to point out that you use our social media presences and their functions at your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also access the information that we provide on social media via our own website.

Data Protection Officer

Our data protection officer is:

Christian Scholtz of WS Datenschutz GmbH

If you have questions regarding data protection, you can contact him at the following email address:

[email protected] or by post at:

WS Datenschutz GmbH

Dircksenstraße 51

D-10178 Berlin

https://webersohnundscholtz.de/

The data protection officers of the respective social media platforms can be contacted via the respective social media services.

You can reach the data protection officer of Facebook and Instagram via the following linked contact form: https://www.facebook.com/help/contact/540977946302970

You can reach the data protection officer of LinkedIn via the following linked contact form: https://www.linkedin.com/help/linkedin/ask/TSO-DPO

You can reach the data protection officer of XING via the following email address: [email protected]

Data Processed by Social Media Platforms

When visiting our social media presences, the operators of the social media platforms collect, among other things, your IP address as well as further information that is stored on your PC in the form of cookies. This information is used to provide us, as the operator of the presence, with statistical information about the use of the page. The data collected about you in this context is processed by the operators of the social media platforms and may be transferred to countries outside the European Union. How the operator of the respective social network receives and uses this information is described in the privacy policies of the respective social networks. There you will also find information about contact options.

Further information can be found at the following links:

Facebook: https://de-de.facebook.com/help/pages/insights
https://de-de.facebook.com/about/privacy
https://de-de.facebook.com/full_data_use_policy

Instagram: https://help.instagram.com/155833707900388
https://www.instagram.com/about/legal/privacy/

LinkedIn: https://www.linkedin.com/legal/privacy-policy

XING: https://www.xing.com/privacy

The manner in which the operators of the social media platforms use data from visits to our social media presences for their own purposes, the extent to which activities on social media presences are assigned to individual users, how long the operators store this data, and whether data from visits to social media presences is passed on to third parties is not conclusively or clearly stated by the operators of the social media platforms and is not known to us.

When accessing our social media presences, the IP address assigned to your device is transmitted to the operator of the respective social network. The social networks also store information about users’ devices (e.g. as part of the “login notification” function). It may therefore be possible for the operators of the social media platforms to assign IP addresses to individual users.

If you are currently logged in to the respective social network as a user, a cookie with your individual identifier for that social network is stored on your device. This allows the operator of the social network to track that you have visited a specific page and how you have used it. Based on this data, content or advertising can be tailored to your previous website visits.

If you wish to avoid this, you should log out of the respective social network or deactivate the “stay logged in” function, delete the cookies stored on your device, and close and restart your browser. In this way, login information through which you can be directly identified will be deleted. This allows you to use our social media presences without revealing your user identifier. If you access interactive functions of the page (like, comment, share, messages, etc.), a login screen will appear. After logging in, you will again be recognizable to the respective social network as a specific user.

Information on how you can manage or delete existing information within the social network can be found on the above-mentioned support pages of the respective social networks.

Data Processed by Us

Type and Scope of Data Processing

The data you enter on social networks, in particular your username and the content published under your account, is processed by us insofar as we may respond to your messages. In addition, we use LinkedIn to contact potential candidates via LinkedIn messages by providing them with a booking link. The publicly available data on LinkedIn is then downloaded and evaluated by us. Formal consent to data storage is obtained after an initial contact via Vincere, although some applicants send their data themselves beforehand.

In addition, your published posts, ratings, and comments refer to your account on the respective social network. If you mention us via an @ or a # or similar, this mention may be published on our page under your username. The data you freely publish and distribute on the respective social network may therefore be integrated into our offering and made accessible to other users of the respective social network. If you mark our social media presence with “Like”, “Follow”, or a similar interaction, this will be communicated to us by the respective social network together with your username and a link to your account.

As the provider of the information service, we also collect and process the following data from your use of our social media presences:

We use the LinkedIn Recruiter System Connect (RSC) function on the LinkedIn platform to get in touch with suitable candidates for open positions. You can specify in your LinkedIn profile privacy settings whether recruiter customers may export profile data packages. For selection and subsequent contact with potential candidates, we process the following data from your LinkedIn profile:

First and last name
Location
Title
Information about your qualifications and professional experience
If applicable, your current employer
Project information (including pipeline status)
Feedback

We use LinkedIn solely for initial contact.

Legal Basis for Processing

The processing of data on our part is based on Art. 6 para. 1 sentence 1 lit. f) GDPR. Our legitimate interest arises from the advertising function of social media. We use these platforms to increase awareness of our company.

Purpose of Processing

The data you provide in this context and that may be accessible to us (e.g. username, images, possibly interests, contact details) is processed by us exclusively for the purpose of customer and prospect communication. Our legitimate interest lies in providing you with a platform on which we can present current information to you and through which you can address your concerns to us, enabling us to respond to your request as quickly as possible.

Duration of Storage

Your data will be deleted, insofar as it is possible for us, when we discontinue our social media presence.

Your Rights

Under the General Data Protection Regulation, you have the following rights:

Right to Withdraw Consent (cf. Art. 7 GDPR)

If you have given consent to the processing of your data, you may withdraw this consent at any time. Such a withdrawal affects the permissibility of processing your personal data in the future after you have declared it to the controller. The withdrawal can be made verbally or in writing by post or email.

Right of Access (cf. Art. 15 GDPR)

In the event of a request for access, you must provide sufficient information about your identity and provide proof that the information concerns you. The information includes:

the purposes for which the personal data are processed;
the categories of personal data that are processed;
the recipients or categories of recipients to whom the personal data concerning you have been disclosed or will be disclosed;
the planned duration of storage of the personal data concerning you or, if specific information is not possible, criteria for determining the storage period;
all available information about the origin of the data if the personal data are not collected from the data subject;
the existence of automated decision-making including profiling pursuant to Art. 22 para. 1 and 4 GDPR and, at least in these cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

Right to Rectification or Erasure (cf. Art. 16, 17 GDPR)

You have the right to rectification and/or completion vis-à-vis the controllers if the personal data processed concerning you is inaccurate or incomplete. The controller must carry out the rectification without delay.

You may also request the erasure of personal data concerning you if one of the following reasons applies:

The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw your consent on which the processing was based pursuant to Art. 6 para. 1 sentence 1 lit. a) or Art. 9 para. 2 lit. a) GDPR and there is no other legal basis for the processing.
You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
The personal data concerning you has been unlawfully processed.
The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
The personal data concerning you was collected in relation to the offer of information society services pursuant to Art. 8 para. 1 GDPR.

If the personal data concerning you has been made public and the controller is obliged to erase it pursuant to Art. 17 para. 1 GDPR, we shall take reasonable steps to inform other controllers responsible for processing the data that you have requested the erasure of all links to this personal data or of copies or replications of this personal data.

The right to erasure does not apply insofar as processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health pursuant to Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89 para. 1 GDPR, insofar as the above-mentioned right is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise, or defence of legal claims.

Right to Restriction of Processing (cf. Art. 18 GDPR)

Under the following conditions, you may request the restriction of the processing of your personal data:

if you contest the accuracy of the personal data concerning you for a period enabling us to verify the accuracy of your personal data;
the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;
we no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise, or defence of legal claims; or
if you have objected to processing pursuant to Art. 21 para. 1 GDPR and it has not yet been determined whether our legitimate grounds override your grounds.

If the processing of personal data concerning you has been restricted, such data may only be processed, apart from storage, with your consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Right to Notification (cf. Art. 19 GDPR)

If you have asserted your right to rectification, erasure, or restriction of processing vis-à-vis a controller, that controller is obliged to notify all recipients to whom your personal data has been disclosed of the rectification, erasure, or restriction of processing. This applies only insofar as such notification does not prove impossible or involves a disproportionate effort.

You have the right to be informed about these recipients.

Right to Data Portability (cf. Art. 20 GDPR)

You have the right to receive your personal data from the controller in a commonly used, machine-readable format in order to transmit it to another controller, provided that

the processing is based on consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR or on a contract pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR, and
the processing is carried out by automated means.

When exercising your right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, insofar as this is technically feasible.

The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Right to Object to Processing (cf. Art. 21 GDPR)

If the processing of your personal data is based on a legitimate interest (pursuant to Art. 6 para. 1 lit. f) GDPR), you may object to the processing. The same applies if the data processing is based on Art. 6 para. 1 sentence 1 lit. e) GDPR.

When exercising such an objection, please explain the reasons why your personal data should not be processed. In the event of your justified objection, the situation will be reviewed and either the data processing will be discontinued or adapted, or we will demonstrate compelling legitimate grounds for continuing the processing.

Right to Lodge a Complaint with the Supervisory Authority (cf. Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR.

The supervisory authority with which the complaint has been lodged will inform you of the status and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

 

How to Exercise These Rights

You may exercise your rights by contacting the data protection officer of the respective controller, whose contact details can be found under section 2. If you exercise any of the above rights, the controller will check whether the legal requirements are met.

If you have questions about our information offering, you can contact us using the contact details listed under section 1.

Further information on social networks and how you can protect your data can also be found at https://youngdata.de.

Right to Amend

We reserve the right to amend this privacy policy in compliance with statutory provisions.

As of October 2024