Privacy Policy

Any collection, use, storage, deletion, or other processing (hereinafter “processing”) of data is intended solely for the purpose of providing our services. Our services have been designed with the goal of using as little personal data as possible. In this context, “personal data” (hereinafter also referred to as “data”) refers to all specific information regarding the personal or factual circumstances of an identified or identifiable natural person (the so-called “data subject”).

The following information on data protection describes what types of personal data are processed when you access our website, what happens to this personal data, and how you can object to data processing if necessary.

1. General Information on Data Processing on This Website

1.1 Controller

The data controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

consultingheads GmbH

Address: Borsigstr. 1, 51381 Leverkusen

Phone: +49 2171 7954780

Email: info@consultingheads.com

Website: consultingheads

1.2 Data Protection Officer

The Data Protection Officer is:

Christian Scholtz of WS Datenschutz GmbH

If you have any questions regarding data protection, you can contact WS Datenschutz GmbH at the following email address: consultingheads@ws-datenschutz.de

WS Datenschutz GmbH
Dircksenstraße 51
D-10178 Berlin

Webersohn & Scholtz

1.3 Protection of Your Data

We have implemented technical and organizational measures to ensure that the provisions of the GDPR are observed both by us and by external service providers working on our behalf.

When we collaborate with other companies—such as email and server providers—to provide our services, we do so only after a comprehensive selection process. During this process, each service provider is carefully evaluated for its suitability in terms of technical and organizational capabilities related to data protection. This selection process is documented in writing, and a contract pursuant to Article 28(3) of the GDPR regarding the processing of personal data on our behalf (Data Processing Agreement) is concluded only if it meets the requirements of Article 28 of the GDPR.

Your information is stored on specially secured servers. Access to this information is restricted to a small number of specifically authorized individuals.

Our website is SSL/TLS-encrypted, which you can recognize by the “https://” at the beginning of the URL. If personal data is involved in email communication, emails sent from our end are encrypted. We also use the integrated SSL certificate for this purpose.

1.4 Deletion of Personal Data

We process personal data only for as long as necessary. Once the purpose of data processing has been fulfilled, the data is blocked and deleted in accordance with our local data deletion policy, unless legal requirements prevent such deletion.

2. Data Processing on This Website and Creation of Log Files

2.1 Description and Scope of Data Processing

When you visit our website, our web servers temporarily store each visit in a log file. The following personal data is collected and stored until it is automatically deleted:

• Access and error log data

In addition to this personal data, we and our partners may collect additional personal data; see below for more details.

To provide our website, we use the services of the hosting provider HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA (see Section 9.1).

For more information, please refer to HubSpot privacy policy.

2.2 Legal Basis for Data Processing

This data is processed on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest is based on making our website accessible to you.

2.3 Purpose of Data Processing

Data processing is carried out for the purpose of enabling the use of the website (establishing a connection). It serves system security, the technical administration of the network infrastructure, and the optimization of the website. The IP address is evaluated only in the event of attacks on our network infrastructure or that of our Internet service provider.

2.4 Duration of Data Storage

Personal data is deleted as soon as it is no longer necessary for the purposes mentioned above. This occurs when you close the website. Our hosting provider may use the data for statistical surveys. However, the data is anonymized for this purpose.

2.5 Options for the Data Subject to Object and Remove Data

The website can only be displayed if the data described is processed. Please submit any objection to the further processing of the data to our Data Protection Officer.

3. Use of Cookies

3.1 Description and Scope of Data Processing

Our website uses cookies. These are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, and through which certain information is transmitted to us or to the entity that sets the cookie. Cookies cannot execute programs or transmit viruses to your computer. We use them to enable you to log in, as well as to analyze the use of our website in an anonymized or pseudonymized form and to present you with offers of interest on this website. In this way, various types of data may be transmitted:

• Frequency of website visits
• Which website features you use
• Search terms used
• Your cookie settings

When you visit the website, a cookie banner informs you about the use of cookies and refers you to the privacy policy.

Note on data processing in the U.S. by Google:

By clicking “Agree to All,” you consent, in accordance with Article 6(1)(a) of the GDPR, to the processing of your data in the U.S. According to the European Court of Justice, data protection standards in the U.S. are insufficient, and there is a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse. If you only consent to the use of essential cookies, the data will not be transferred. Consent that has been given may be revoked at any time.

3.2 Legal Basis for Data Processing

The legal basis for the processing of data via cookies that do not serve solely to ensure the functionality of our website is Article 6(1), sentence 1, letter a) of the GDPR.

The legal basis for data processing involving cookies that serve solely to ensure the functionality of this website is Article 6(1), sentence 1, subparagraph (f) of the GDPR.

3.3 Purpose of Data Processing

Our legitimate interest stems from ensuring a smooth connection and a convenient user experience on our website, as well as from the need to evaluate system security and stability. Data processing also takes place to enable statistical analysis of website usage.

3.4 Duration of Data Storage

There are two types of cookies. Both are used on this website:

• Transient cookies (see a)
• Persistent cookies (see b)

a) Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. They store a so-called session ID, which allows various requests from your browser to be assigned to the same session. This enables your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close your browser.

b) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.

The data is stored only as long as necessary for verification purposes, unless legal requirements mandate longer storage of the data.

3.5 Options for the Data Subject to Object and Remove Data

You may revoke your consent to data processing via cookies—other than those strictly necessary for the website’s functionality—at any time. Additionally, we do not set cookies until you have consented to their use when accessing the site. This allows you to prevent data processing via cookies on our website.

You can also delete cookies at any time in your browser’s security settings. Please note that you may not be able to use all features of this website. You can also prevent cookies from being set at any time by adjusting the settings in your web browser.

3.6 CCIM

CCIM is integrated into the website as a cookie consent solution and ensures compliance with data protection laws. CCIM manages the consents you provide via the consent banner. The following data is processed for this purpose:

• Your IP address

This data is processed on the basis of Article 6(1)(c) of the GDPR.

The data is processed locally on your devices. No data is transferred to third countries.

For more information about data processing, please see: CCM19 privacy policy

4. Contact

4.1 Description and Scope of Data Processing

You can contact us via our website by sending an email to info@consultingheads.com or by using a contact form. To respond to your inquiry, various data are required and are automatically stored for processing purposes. At a minimum, the following data is collected via the contact form (marked as required fields):

Contact form “Find a consultinghead”:

• First Name
• Last Name
• Phone
• Email address

You may also provide the following information (optional):

• Company
• Employment status
• Message

Contact form “Become a consultinghead”:

• Search query (dropdown)
• First Name
• Last Name
• Cell Phone Number
• Email Address
• Profile Upload / Project List

You may also provide the following information (optional):

• Personal elevator pitch
• LinkedIn profile URL

Your data will not be shared with third parties.

4.2 Legal Basis for Data Processing

The legal basis used here is Article 6(1)(b) of the GDPR.

4.3 Purpose of Data Processing

We process your data exclusively to handle your contact request.

4.4 Duration of Data Storage

We will delete your data as soon as the purpose of data processing has been fulfilled, which is usually immediately after responding to your inquiry. In rare cases, however, we may retain your data for a longer period. This may be required by legal, regulatory, or contractual obligations.

4.5 Options for the Data Subject to Object and Remove Data

You may contact us at any time to object to the further processing of your data. In this case, we will unfortunately be unable to continue communicating with you. All personal data processed by us in the course of your contact with us will be deleted in this case, unless legal obligations to retain your data prevent such deletion.

5. Data Processing in Connection with Applications

5.1 Description and Scope of Data Processing

Through our job board at consultingheads.com/en/projects you can apply for advertised projects or submit your resume for future projects. Alternatively, you can apply by email at info@consultingheads.com. In the application form, we process the following data in particular:

• First name and last name
• Email address
• Cell phone number
• Resume and other documents you upload
• Information regarding qualifications and availability
• Your consent form

The information from the form is transmitted to a service we operate in Microsoft Azure (see Section 5.8). This service creates your application in our Vincere recruiting software (see Section 5.6) and stores your contact information in our HubSpot CRM system (see Section 9.1). Your data will be used there exclusively for the application and placement process and will not be used for advertising purposes. You will only subscribe to our newsletter if you actively select the separate checkbox provided for this purpose (see Section 6).

5.2 Legal Basis for Data Processing

The legal bases for data processing are Article 88 of the GDPR and Section 26 of the BDSG.

5.3 Purpose of Data Processing

We process your data exclusively for the purpose of conducting the application process.

5.4 Duration of Data Storage

If the application leads to the establishment of an employment relationship, the personal data will be stored in accordance with applicable legal provisions. If your application is not considered in the selection of a potential candidate, it will be deleted in accordance with the rules of our local data deletion policy, taking into account the provisions of the AGG, in particular the existing burden of proof under Section 22 of the AGG.

This does not apply if statutory provisions preclude deletion or if you have given your consent to longer-term storage. In this case, the continued storage of your personal data is based on Article 6(1), sentence 1, lit. c) or lit. a) of the GDPR.

5.5 Options for the Data Subject to Object and Remove Data

You may contact us at any time to object to the further processing of your data. In this case, all personal data processed by us in the course of the application process will be deleted, unless mandatory legal provisions preclude such deletion.

5.6 Vincere.io

5.6.1 Description and Scope of Data Processing

We use the recruiting software “Vincere.io” to manage applications and candidate profiles. Data processing is carried out by: HiringBoss Holdings Pte Ltd, 120 Robinson Road, #15-01, 068193 Singapore.

The following data is stored in Vincere.io in this context:

• Name and contact information
• Resume and other application documents
• Professional history, qualifications, and areas of expertise
• Information on availability and daily or hourly rate
• Communication related to the application and placement process

For more information, please see Vincere.io’s Privacy Policy at the following link: Vincere privacy policy

5.6.2 Legal Basis for Data Processing

The legal basis for the use of Vincere.io is our legitimate interest in the efficient management of applications and candidate profiles pursuant to Art. 6(1)(f) of the GDPR.

5.6.3 Purpose of Data Processing

The purpose of data processing is to optimize our application management.

5.6.4 Duration of Data Storage

The data will be deleted as soon as the purpose of the data processing has been fulfilled and no statutory, contractual, or regulatory retention periods prevent its deletion.

5.6.5 Options for the Data Subject to Object and Remove Data

You have the right to object to data processing at any time by notifying our Data Protection Officer. If you have any questions regarding data protection at Vincere.io, you can contact Vincere.io at any time at the following email address: privacy@vincere.io.

If you wish to opt out of data processing by Vincere.io and do not wish to use our job board, you also have the option of sending your application directly to us via email at info@consultingheads.com.

5.7 Call Recording

5.7.1 Description and Scope of Data Processing

If you contact us by phone or participate in an online meeting, the conversation will be recorded with your consent and subsequently transcribed. This recording is used to store the meeting notes in our Vincere CRM system.

We use the tool fireflies.ai to record and transcribe online meetings. Data processing is carried out by: Fireflies.AI Corp., 5424 Sunol Blvd, Ste 10-531 Pleasanton, CA 94566, USA.

For additional information on data protection, please see: Fireflies.ai privacy policy (PDF)

We also use the Comdesk tool to record and transcribe phone calls. Data processing is carried out by: Comdesk GmbH, Neuenkampsweg 4, 25337 Kölln-Reisiek, Germany.

For additional information on data protection, please see: comdesk privacy policy

5.7.2 Legal Basis for Data Processing

The legal basis for data processing is your consent pursuant to Art. 6(1)(a) of the GDPR.

5.7.3 Purpose of Data Processing

We document the content of phone calls and online meetings as part of our business operations. Recording and automatic transcription are intended to facilitate this process for our employees. Additionally, the recordings serve the purpose of quality assurance.

5.7.4 Duration of Data Processing

The recording of the conversation is stored in Fireflies or Inopla / Comdesk and is automatically deleted after 3 months or immediately upon revocation of consent. The generated transcript is transferred to the Vincere CRM system and stored there (for a specific purpose) in accordance with the applicable retention periods for call notes.

5.7.5 Options for the Data Subject to Object and Remove Data

You may revoke your consent to data processing at any time. To do so, please contact info@consultingheads.com.

If you have any questions regarding data protection at Fireflies.ai, please contact us via email at security@Fireflies.ai.

For questions regarding data protection at Comdesk GmbH, please contact us via email at comdesk.dsb@sidit.de.

5.8 Microsoft Azure and Azure OpenAI

5.8.1 Description and Scope of Data Processing

We operate our job board and our internal recruiting platform in the Microsoft Azure cloud environment. Data processing is carried out by: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We exclusively use data centers located in the European Union (in Germany and Western Europe). These data centers hold various certifications, including ISO 27001.

Specifically, the following services run on Azure:

• the service that receives applications from our job board and forwards them to Vincere and HubSpot,
• a copy of our candidate database from Vincere, which is synchronized daily; Vincere remains the primary system,
• our internal recruiter dashboard, which our employees use to search candidate profiles and assign them to projects. Access is restricted to authorized employees, is read-only, and is logged.

The following data, in particular, is processed as part of data processing:

• Name and contact information
• Resume and other documents
• Professional history, qualifications, and areas of expertise
• Information on availability and daily or hourly rate
• Comments and communications from the application and placement process
• Consents granted

AI Analysis of Resumes: We use the Azure OpenAI service to search our candidate database. This process involves reading resumes, making them searchable, and converting them into a structured overview (e.g., qualifications, work history, areas of expertise). The AI model runs in a data center in Germany within Microsoft’s EU data zone and is accessible only via a private connection. Microsoft does not use the data to train AI models. The AI does not evaluate individuals or create rankings. The selection for a project is always made by a human; there is no fully automated decision-making within the meaning of Article 22 of the GDPR.

Further information: Microsoft privacy statement

5.8.2 Legal Basis for Data Processing

To the extent that the processing serves the purpose of handling your application or placement in a project, the legal basis is Article 6(1)(b) of the GDPR. In all other cases, the processing is based on our legitimate interest pursuant to Article 6(1), first sentence, (f) of the GDPR in the secure, efficient management and searchability of our candidate database in order to quickly staff project enquiries with suitable experts. To the extent that you have provided consent, the legal basis is additionally Article 6(1), first sentence, (a) of the GDPR.

5.8.3 Purpose of Data Processing

Data processing is carried out for the purpose of receiving applications through our job board, finding suitable candidates for project enquiries, and ensuring the integrity of our candidate database by maintaining a secure backup.

5.8.4 Duration of Data Storage

The copy in Azure follows the status of the data in Vincere: If your data is deleted or archived in Vincere, it will also be deleted in Azure. Furthermore, the data will be deleted as soon as the purpose of data storage has been fulfilled and there are no contractual, regulatory, or legal retention obligations that prevent this.

5.8.5 Options for the Data Subject to Object and Remove Data

You have the right to object to data processing at any time by notifying our Data Protection Officer. You may revoke any consent you have given at any time with future effect.

If you do not wish to use our job board, you also have the option of sending your application directly via email to info@consultingheads.com.

5.9 Broadbean

5.9.1 Description and Scope of Data Processing

To publish our job postings on multiple job boards simultaneously, we use the multiposting software Broadbean. Data processing is carried out by: Broadbean Technology Limited, 77 Marsh Wall, London E14 9SH, United Kingdom (a Veritone Group company). If you apply through one of these job boards, your application data is first received by Broadbean and then transferred from there to our recruiting software, Vincere (see Section 5.6). In particular, the following data is processed:

• Name and contact information
• Resume and other application documents
• Information from your profile on the respective job board
• Date of application and reference to the request for proposal

An adequacy decision has been issued by the European Commission for the United Kingdom (see Section 15). For more information, please refer to Broadbean (Veritone) privacy policy.

5.9.2 Legal Basis for Data Processing

Data processing is carried out for the purpose of conducting the application and recruitment process in accordance with Article 6(1)(b) of the GDPR, as well as on the basis of our legitimate interest in the efficient publication of our requests for proposals in accordance with Article 6(1)(f) GDPR.

5.9.3 Purpose of Data Processing

The processing serves to publish our project job postings on multiple job boards and to collect applications in a centralized manner.

5.9.4 Duration of Data Storage

Application data is stored by Broadbean only for as long as necessary to transfer it to our recruiting software and as provided for in the data processing agreement. In all other respects, the retention periods set forth in Section 5 apply.

5.9.5 Options for the Data Subject to Object and Remove Data

You have the right to object to data processing at any time by notifying our Data Protection Officer. Alternatively, you can apply directly by email to info@consultingheads.com.

6. Newsletter

6.1 Description and Scope of Data Processing

We offer the option to subscribe to our newsletter on our website. When subscribing to the newsletter, you will be asked to provide personal data for processing. This includes the data requested in the newsletter subscription form. Fields marked with an “*” are required:

• First Name
• Last Name
• Email address

These required fields are necessary to send you the newsletter.

The newsletter is sent via email. You will only receive the newsletter after you have successfully subscribed. To comply with the requirements of the GDPR, we use the so-called DOI procedure (“Double Opt-In”). If you subscribe to our newsletter, you will receive a confirmation email at the email address you provided in the input field. This email contains a confirmation link that you must click. Once you have completed this process, you will have successfully subscribed to the newsletter. To carry out this process, your IP address, as well as the date and time of your registration, are stored. This is done to prevent misuse. We use the service provider Brevo to send the newsletter (see Section 6.6); the data is not shared with any other third parties.

6.2 Legal Basis for Data Processing

The legal basis for data processing is your consent pursuant to Art. 6(1)(a) of the GDPR.

6.3 Purpose of Data Processing

The purpose of the newsletter is to inform you at regular intervals about our offers and news.

6.4 Duration of Data Storage

We process your data only for as long as is necessary to fulfill the purpose and provided that no legal or regulatory retention requirements prevent its deletion.

6.5 Options for the Data Subject to Object and Remove Data

Consent to the processing of personal data in connection with the newsletter subscription may be revoked at any time. To do so, you may click the unsubscribe link included in every newsletter or notify us of the revocation of consent by other means.

6.6 Brevo

6.6.1 Description and Scope of Data Processing

We use the email service provider Brevo to send our newsletter and other emails. Data processing is carried out by: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. The data is processed on servers located in the European Union.

When sending emails to you via Brevo, the following personal data is processed:

• Name
• Email address
• Content of the email
• Time of registration and confirmation (double opt-in)
• Information regarding whether and when an email was delivered and opened, as well as which links were clicked

We have entered into a data processing agreement with Brevo in accordance with Article 28 of the GDPR. For more information, please see Brevo privacy policy.

6.6.2 Legal Basis for Data Processing

The newsletter is sent based on your consent in accordance with Article 6(1)(a) of the GDPR. The sending of other emails, such as to confirm a registration or as part of an existing business relationship, is based on our legitimate interest in reliable and secure delivery pursuant to Article 6(1), first sentence, (f) GDPR or for the performance of a contract pursuant to Art. 6(1), sentence 1, lit. b) GDPR.

6.6.3 Purpose of Data Processing

The purpose of data processing is the sending and reliable delivery of emails, as well as the statistical analysis of the newsletter.

6.6.4 Duration of Data Storage

The data will be stored until you revoke your consent or the purpose for storage no longer applies. Upon termination of our contractual relationship with Brevo, the data will be deleted in accordance with the provisions of the data processing agreement.

6.6.5 Options for the Data Subject to Object and Remove Data

You can unsubscribe from the newsletter at any time using the unsubscribe link in every email. In addition, you can exercise your rights at any time by contacting us using the contact information provided or by contacting our Data Protection Officer.

7. Social Media Links

We have integrated social media platforms into our services via links, which may result in the social media providers receiving data from you. If you click on a social media link, you will be redirected to the website of the respective social media provider. When you access the website of the respective social media provider through our services, the relevant reference data is transmitted to that provider. This informs the social media provider that you have visited our site.

For more information on data processing by social media providers, see below:

Facebook: Facebook Page Insights information,
Facebook privacy policy,
Facebook data use policy
Instagram: Instagram help article on data protection
Instagram privacy policy
LinkedIn: LinkedIn privacy policy

8. Trackers and Analytics Tools

To continuously improve our website, we use the following analytics tools. The following sections explain what data is processed in each case and how you can contact the respective service providers:

8.1 Google Analytics

8.1.1 Description and Scope of Data Processing

Our website uses Google Analytics. This is a service provided by Google LLC (“Google”) for analyzing website traffic and enables us to improve our website. Data processing for the European Economic Area and Switzerland is carried out by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Cookies enable us to analyze your use of our website. The information collected via cookies includes:

• IP address,
• time of access,
• Duration of visit

and is transmitted to a Google server in the United States and stored there. The analysis of your activities on our website is provided to us in the form of reports. Google may disclose the collected information to third parties if required by law or if such third parties process the data on Google’s behalf. The Google tracking codes on our website use the “_anonymizeIp()” function, which means that IP addresses are processed in a truncated form to prevent any direct association with you. You can find more detailed information about the terms of use and privacy policy of Google Analytics in Google policies and Google Analytics terms of service.

8.1.2 Legal Basis for Data Processing

The legal basis for the processing of personal data is your consent pursuant to Art. 6(1)(a) of the GDPR.

8.1.3 Purpose of Data Processing

Processing your personal data enables us to analyze your browsing behavior. By evaluating the data collected, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness.

8.1.4 Duration of Data Storage

The data will be deleted 14 months after your visit to our website.

8.1.5 Options for the Data Subject to Object and Remove Data

You may revoke your consent to data processing at any time with future effect. To do so, please contact our Data Protection Officer. You can also prevent the installation of Google Analytics cookies yourself by adjusting the settings in your browser software accordingly. In this case, however, you may not be able to use all features of our website to their full extent. Google Analytics can also be deactivated and controlled using browser extensions, such as Google Analytics opt-out browser add-on.

8.2 Google Tag Manager

8.2.1 Description and Scope of Data Processing

Google Tag Manager is a solution that allows us to manage so-called website tags via a user interface (and thus, for example, integrate Google Marketing Services into our online offering). Tag Manager serves as the “manager” of the implemented tags. This allows us to centrally manage integrated Google products or other analytics tools on our website. The tags embedded on the website are sections of code that enable the tracking of your activities on our website. When you use our website, Google Tag Manager is downloaded, which automatically results in the user’s IP address being forwarded to Google. With regard to the processing of personal data, please refer to the information provided by Google regarding its services. Data processing for the European Economic Area and Switzerland is carried out by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

You can access the Google Tag Manager Terms of Service here: Google Tag Manager use policy

8.2.2 Legal Basis for Data Processing

The legal basis for the processing of personal data is your consent pursuant to Art. 6(1)(a) of the GDPR.

8.2.3 Purpose of Data Processing

Google Tag Manager simplifies the management and organization of the analytics tools used on the website. To integrate an analytics tool, JavaScript code must be embedded in the website. Using Google Tag Manager allows us to manage this embedded code from a single location.

8.2.4 Duration of Data Storage

Since Google Tag Manager does not store data directly but instead forwards the data to the tracking tools, you must check the individual integrated tracking tools to determine how long the data is stored.

8.2.5 Options for the Data Subject to Object and Remove Data

You have the option at any time to revoke your consent to data processing with future effect. To do so, you must contact the respective data protection officers for the tools in question. Further information regarding the management of your data can be found in the privacy policies of the tools used.

8.3 Microsoft Clarity

8.3.1 Description and Scope of Data Processing

Our website uses Microsoft Clarity. This is a service provided by Microsoft Corporation for analyzing website traffic and enables us to improve our website.

Data processing for the European Economic Area and Switzerland is carried out by: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, a subsidiary of: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

The information collected includes, among other things:

• IP address,
• time of access,
• Duration of visit
• Interactions on the website (clicks, scrolls, mouse movements)
• Location
• Browser information
• Screen resolution
• Language settings

Cookies are used to collect and analyze this data, provided you consent to this data processing. Cookies are small text files that are stored locally in the cache of the website visitor’s web browser. Cookies enable the web browser to be recognized. The information collected via a cookie may be transmitted to a Microsoft Corporation server in the United States and stored there. We have entered into a data processing agreement with Microsoft that obligates Microsoft to protect our customers’ data. For more information on data protection at Microsoft, please see here: Microsoft privacy statement

8.3.2 Legal Basis for Data Processing

The legal basis for the processing of personal data is your consent pursuant to Art. 6(1)(a) of the GDPR.

8.3.3 Purpose of Data Processing

Processing your personal data enables us to analyze your use of our website. By evaluating the data collected, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness.

8.3.4 Duration of Data Storage

Microsoft Clarity typically stores user data such as clicks, scrolls, mouse movements, and session recordings for 30 days. Aggregated data (click data, heat maps, project overviews) as well as sessions marked as favorites are stored for up to 13 months.

8.3.5 Options for the Data Subject to Object and Remove Data

You may revoke your consent to data processing at any time. To do so, you can change your settings in our Consent Manager.

8.4 LinkedIn Insight Tag

8.4.1 Description and Scope of Data Processing

Our website uses the LinkedIn Insight Tag. Data processing is carried out by: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. The Insight Tag is only loaded if you have given your consent via our Consent Manager.

The Insight Tag sets cookies and collects the following information in particular:

• IP address (truncated or pseudonymized)
• Page visited and referrer URL
• Time of the visit
• Device and browser characteristics
• Your LinkedIn member ID, if you are logged in to LinkedIn

We receive only aggregated, anonymous reports from LinkedIn regarding our website’s target audience and the effectiveness of our content; we are unable to identify individual visitors. According to LinkedIn, direct identifiers are pseudonymized within seven days, and the remaining data is deleted after 180 days. Data may be transferred to LinkedIn Corporation in the United States. For more information, please see LinkedIn privacy policy.

8.4.2 Legal Basis for Data Processing

The legal basis for the processing is your consent pursuant to Art. 6(1)(a) of the GDPR.

8.4.3 Purpose of Data Processing

The processing serves to analyze visitor groups on our website and to measure the success of our content and activities on LinkedIn.

8.4.4 Duration of Data Storage

Cookies are deleted after six months at the latest, unless you delete them from your browser beforehand. For information on the retention period on LinkedIn, see above.

8.4.5 Options for the Data Subject to Object and Remove Data

You can revoke your consent at any time, effective for the future, by changing your settings in our Consent Manager. As a LinkedIn member, you can also control this use in your LinkedIn settings for advertising data.

9. Marketing and CRM Tools

We use the following platform to manage our contacts, our communications, and to analyze our website:

9.1 HubSpot

9.1.1 Description and Scope of Data Processing

We use “HubSpot,” a platform for content management (CMS), Marketing, sales, customer management, and customer service. Data processing is carried out by: HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA.

HubSpot collects the data provided in the contact form, as well as the date and time the email was opened, and stores this information in our software. Your data is stored on servers in the United States.

Our website is powered by the HubSpot CMS. We also use the service for analytics and to evaluate the use of our website. In this context, HubSpot processes various types of personal data

Appointment bookings, such as for an introductory meeting, are made exclusively through the HubSpot Meetings booking tool. In doing so, we process your name, your email address, the selected appointment time, and, if applicable, your message to us. The legal basis is Art. 6(1)(b) of the GDPR.

HubSpot does not use the data or share it with third parties. We rely on HubSpot’s reliability and its IT and data security measures. For more information on data protection at HubSpot, please see HubSpot terms of service.

9.1.2 Legal Basis for Data Processing

HubSpot processes the data you provide in the contact form in accordance with Article 6(1)(b) of the GDPR.

The legal basis for processing data for analytical purposes and regarding the date and time the email was opened is your consent pursuant to Article 6(1)(a) of the GDPR.

9.1.3 Purpose of Data Processing

We use HubSpot as our service provider to ensure effective address management and to be able to contact you via a contact form.

We use HubSpot to effectively analyze user behavior on our website.

9.1.4 Duration of Data Storage

According to HubSpot, HubSpot stores your personal data only for as long as we use your personal data. HubSpot deletes your data if we remove you from our contact list or delete our HubSpot account after a period of 30 days.

9.1.5 Options for the Data Subject to Object and Remove Data

You have the right to withdraw your consent to data processing at any time. You also have the right to object to data processing at any time. To do so, please contact our Data Protection Officer.

10. Automation and Data Synchronization Between Our Systems

10.1 Description and Scope of Data Processing

To avoid having to transfer data between our systems manually, we use automation tools. In particular, contact information for customers, prospects, candidates, and freelancers, as well as company data and project and contract data, are transferred between our systems (specifically HubSpot and Vincere):

• n8n – software for automating workflows, which we use to synchronize deals, companies, and contacts between HubSpot and Vincere. We operate n8n ourselves on a server provided by the hosting provider Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus; the data is not transmitted to the manufacturer of n8n. Hostinger privacy policy
• Zapier – A platform for linking our applications, which we use to automate individual workflows. Provider: Zapier Inc., USA; EU representative: DP-Dock GmbH, Ballindamm 39, 20095 Hamburg, Germany. Zapier is certified under the EU-US Data Privacy Framework. Zapier privacy policy

For transfers to third countries, see Section 15.

10.2 Legal Basis for Data Processing

Processing is based on our legitimate interest in efficient, error-free data management pursuant to Art. 6(1)(f) of the GDPR and, to the extent that it serves the performance of a contract, pursuant to Art. 6(1)(b) of the GDPR.

10.3 Purpose of Data Processing

Automation serves to ensure data consistency across our systems and to prevent manual transfer errors.

10.4 Duration of Data Storage

The tools store data only temporarily for the execution of processes and in execution logs, which are deleted regularly. The retention periods of the target systems are decisive.

10.5 Options for the Data Subject to Object and Remove Data

You may object to the processing at any time in accordance with Article 21 of the GDPR. To do so, please contact our Data Protection Officer or info@consultingheads.com.

11. Sales and Customer Acquisition

11.1 Description and Scope of Data Processing

In order to identify suitable contacts at companies, management consulting firms, and private equity firms and to offer them our services, we process business contact data that we did not collect directly from you (Art. 14 GDPR). This includes, in particular:

• Name, position, and role
• Company
• Business email address and phone number
• Link to your profile on professional networks such as LinkedIn

The data comes from publicly available sources, such as professional networks and company websites, as well as from the following providers:

• Lusha – Database for business contact information. Provider: Lusha Systems Inc., 1177 Avenue of the Americas, 5th Floor, New York, NY 10036, USA. Lusha website
• Surfe – A browser extension that allows us to import contact information from LinkedIn into our CRM system and supplement it with business email addresses and phone numbers. Provider: Growster SAS, 17 allée des Gassets, 77700 Serris, France. Surfe privacy policy

The data is stored in our HubSpot CRM system (see Section 9.1). With Lusha, processing may take place in the U.S.; for information on safeguards, see Section 15.

11.2 Legal Basis for Data Processing

Processing is based on our legitimate interest in acquiring new customers and establishing business relationships in accordance with Art. 6(1)(f) of the GDPR.

11.3 Purpose of Data Processing

The purpose of processing is to identify the appropriate contacts and to establish business contact with them.

11.4 Duration of Data Storage

The data will be deleted as soon as it is no longer necessary for establishing a business relationship or if you object to the processing. If a business relationship is established, the retention periods applicable to that business relationship will apply.

11.5 Options for the Data Subject to Object and Remove Data

You may object to the processing of your data for the purpose of direct marketing at any time without providing a reason (Art. 21(2) GDPR). To do so, please contact info@consultingheads.com or our Data Protection Officer. After you object, we will delete your data; to ensure you are not contacted again, we will only store the information necessary for this purpose in a suppression list.

12. Project Delivery, Time Tracking and Billing

12.1 Description and Scope of Data Processing

We use the ZEIT.IO software to record and approve project hours and expenses, as well as for billing our clients and the freelancers we place. Provider: REIZ Solutions GmbH, Neckarauer-Waldweg 27, 68161 Mannheim, Germany. In particular, the following data is processed:

• Names and contact information of freelancers and client contacts
• Project and contract data
• Recorded hours, expenses, and task descriptions
• Approvals
• Invoice, credit memo, and payment data

For more information, please see the ZEIT.IO privacy policy.

12.2 Legal Basis for Data Processing

Data processing is carried out to fulfill contracts with our customers and freelancers in accordance with Art. 6(1)(b) of the GDPR, as well as to comply with statutory retention and documentation requirements in accordance with Art. 6(1)(c) of the GDPR.

12.3 Purpose of Data Processing

Data processing serves to document services rendered and to ensure accurate billing for customers and freelancers.

12.4 Duration of Data Storage

The data is stored for the duration of the contractual relationship. We retain documents relevant to billing for up to ten years in accordance with commercial and tax law requirements (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)).

12.5 Options for the Data Subject to Object and Remove Data

Since the processing is necessary for the performance of the contract and compliance with legal obligations, there is no right to object in this regard. You may exercise your other rights (Section 16) at any time by contacting us or our Data Protection Officer.

13. Other Third-Party Tools

We also use third-party providers who assist us with the presentation and functionality of the website. These are listed below:

13.1 Cloudflare

13.1.1 Description and Scope of Data Processing

On our website, we use Cloudflare’s services to ensure secure and error-free use of our website. As a CDN (“Content Delivery Network”), Cloudflare secures this website and optimizes loading times. To this end, Cloudflare generates log data that may include, for example, the number of page views, IP address, system information, and information about the pages accessed before and after your visit to our website. Cloudflare uses this data to detect attack patterns, the analysis of which helps protect our website. This analysis typically takes place within a few minutes, allowing our website’s security rules to be updated immediately. The entity responsible for data processing is: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

For more information, please see Cloudflare’s Privacy Policy: Cloudflare privacy policy

13.1.2 Legal Basis for Data Processing

Data processing is based on your consent in accordance with Art. 6(1)(a) of the GDPR.

13.1.3 Purpose of Data Processing

The purpose of this data processing is to ensure the confidentiality and integrity of our data processing as well as the full functionality of our website.

13.1.4 Duration of Data Storage

Your data will be stored only as long as necessary to fulfill the purpose and provided that no legal obligations to retain your data prevent its deletion.

13.1.5 Options for the Data Subject to Object and Remove Data

You may revoke your consent to data processing at any time. To do so, please contact our Data Protection Officer. You can prevent Cloudflare from processing your data by disabling the execution of script code in your browser or by installing a script blocker; however, this may result in our website no longer displaying properly.

13.2 Self-Hosted Fonts

13.2.1 Description and Scope of Data Processing

We use so-called web fonts and icons on our website to ensure consistent font display. When you visit a page, your browser loads the necessary web fonts and icons into your browser cache to display text and fonts correctly. We have integrated these locally on our own website so that Google and Font Awesome are not aware that our website was accessed via your IP address. If your browser does not support web fonts or icons, a default font from your computer will be used.

13.2.2 Legal Basis for Data Processing

The legal basis is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR.

13.2.3 Purpose of Data Processing

The purpose of data processing is to ensure consistent font display on this website in order to provide a visually appealing and user-friendly website.

13.2.4 Duration of Data Storage

No data is stored.

13.2.5 Options for the Data Subject to Object and Remove Data

You can configure your browser so that it does not support web fonts/icons. In this case, a default font from your computer will be used.

13.3 Trustmary

13.3.1 Description and Scope of Data Processing

We have integrated the services of Trustmary Oy into our website. Data processing is carried out by: Trustmary Oy, Kauppakatu 39, 40100 Jyväskylä, Finland.

We use Trustmary to give our customers the opportunity to rate our services and products and to display other customers’ reviews on our website.

For this purpose, we have integrated a so-called widget into our website that is connected to the Trustmary platform to display current reviews and customer testimonials. When you visit a page on which such a widget is integrated, Trustmary processes the following data:

• IP address
• Browser type, language, and version of the browser software
• Date and time of access
• Webpage accessed
• Referrer URL (the previously visited page)

If you submit a review via a review link or a form, the following personal data may also be processed:

• Name or pseudonym
• Email address
• Content of the review
• Time of the review

The review you submit may subsequently be displayed on our website or in other communication channels we use (e.g., marketing materials).

For more information on data processing by Trustmary, please see: Trustmary privacy policy

13.3.2 Legal Basis for Data Processing

Data processing in connection with the display of reviews on our website is based on your consent pursuant to Art. 6(1)(a) of the GDPR, which is obtained through our consent management system.

The processing of personal data in connection with submitting a review is also based on your consent pursuant to Article 6(1)(a) of the GDPR.

To the extent that the processing of data serves the technical provision of the review widget, it is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR to enable a transparent display of customer reviews.

13.3.3 Purpose of Data Processing

The purpose of data processing is to enable a transparent and independent evaluation of the services and products we offer.

The reviews you submit help us:

• improve the quality of our services
• build trust among potential customers
• to highlight the experiences of other customers

We may use reviews in their original or aggregated form on our website or in marketing materials.

13.3.4 Duration of Data Storage

The personal data you provide as part of a review is generally stored by Trustmary for as long as necessary to provide the review feature or until you revoke your consent.

If you request that your review be deleted, it will generally be removed from publicly visible areas. Statutory retention requirements remain unaffected by this.

13.3.5 Options for the Data Subject to Object and Remove Data

You have the right to object to the processing of your personal data at any time.

To the extent that processing is based on your consent pursuant to Art. 6(1)(a) of the GDPR, you may withdraw this consent at any time with future effect. You may withdraw your consent via the settings of our consent management tool or by sending us a corresponding notice.

In addition, you may at any time request the deletion or modification of a review you have submitted. To do so, please contact our Data Protection Officer or Trustmary directly at privacy@trustmary.com

14. Use of Artificial Intelligence Tools

14.1 Description and Scope of Data Processing

We use artificial intelligence (AI) tools in our company to generate, translate, and summarize texts; prepare project enquiries and project calls for proposals; evaluate candidate profiles and resumes, prepare our communications with clients, candidates, and prospective clients, and maintain our website and CRM system. In doing so, personal data may also be processed, in particular names, contact information, details from resumes and project profiles, as well as the content of our communications.

We use these tools exclusively under business plans, and we have entered into data processing agreements with their providers in accordance with Article 28 of the GDPR. The providers are contractually obligated not to use your data to train their AI models. AI results are reviewed by our employees; decisions regarding individuals are always made by a human—there is no fully automated decision-making within the meaning of Article 22 of the GDPR. Specifically, we use:

• Anthropic Claude – Provider: Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Anthropic privacy policy
• ChatGPT – Provider: OpenAI Ireland Limited, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. OpenAI privacy policy
• Langdock – An AI platform through which we use various AI models, including for the creation of anonymized project requests for proposals. Provider: Langdock GmbH, Greifswalder Str. 212, 10405 Berlin, Germany. Langdock privacy policy
• HubSpot Breeze – AI features within our HubSpot CRM system; for the provider, see Section 9.1.
• DeepL – Translation of texts, particularly our website and project texts. Provider: DeepL SE, Maarweg 165, 50825 Cologne, Germany. DeepL privacy policy
• Azure OpenAI – Analysis of resumes on our recruiting platform; see Section 5.8.

In the case of Anthropic and OpenAI, data processing may also take place in the U.S.; for information on safeguards regarding transfers to third countries, see Section 15.

14.2 Legal Basis for Data Processing

To the extent that processing serves the performance of a contract or precontractual measures—such as placement in a project—the legal basis is Article 6(1), first sentence, letter b) of the GDPR. In all other cases, processing is based on our legitimate interest in efficient work organization and the prompt, high-quality handling of inquiries pursuant to Article 6(1), first sentence, (f) of the GDPR.

14.3 Purpose of Data Processing

The use of AI tools serves to process inquiries more quickly and with consistent quality, to find suitable experts for projects, and to make our content available in multiple languages.

14.4 Duration of Data Storage

Inputs and results are stored by the providers only for as long as provided for in the respective data processing agreement. In our own systems, the retention periods applicable to the respective processing apply, such as in the context of job applications (Section 5).

14.5 Options for the Data Subject to Object and Remove Data

You may object to the processing of your data using AI tools at any time in accordance with Art. 21 of the GDPR. To do so, please contact our Data Protection Officer or info@consultingheads.com.

15. Data Transfer to a Third Country

To provide our services, we rely on the support of service providers located both within the European Union and in third countries. To ensure the protection of your personal data even in the event of data transfers to a third country, we enter into specific data processing agreements with each of our carefully selected service providers. All service providers we use have provided sufficient evidence that they ensure data security through appropriate technical and organizational measures. Our service providers in third countries are either located in countries that have an adequate level of data protection recognized by the European Commission (Art. 45 GDPR) or have provided appropriate safeguards (Art. 46 GDPR).

Adequate Level of Protection: The provider is based in a country whose adequate level of data protection has been recognized by the European Commission. For more information, see: Adequacy decisions (europa.eu)

EU Standard Contractual Clauses: Our provider has adopted the EU Standard Contractual Clauses to ensure secure data transfer. For more information, see: EU standard contractual clauses (Implementing Decision 2021/914)

Binding Corporate Rules: Article 47 of the GDPR provides for the option of ensuring data protection during data transfers to a third country through binding internal data protection rules. These are reviewed and approved by the competent supervisory authorities as part of the consistency mechanism under Article 63 of the GDPR.

Consent: Furthermore, data transfers to a third country without an adequate level of protection will only take place if you have given us your consent in accordance with Article 49(1)(a) of the GDPR or if another exception under Article 49 of the GDPR applies to the data transfer.

16. Your Rights

You have the following rights with respect to the personal data concerning you:

16.1 Right to Withdraw Consent (see Art. 7 GDPR)

If you have given consent to the processing of your data, you may withdraw it at any time. Such a withdrawal affects the lawfulness of the processing of your personal data going forward, once you have notified us of it. It may be made orally (in person or remotely) or in writing by mail or email to us.

16.2 Right of Access (see Art. 15 GDPR)

In the event of a request for access, you must provide sufficient information regarding your identity and prove that the information in question pertains to you. The access request pertains to the following information:

• the purposes for which the personal data is processed;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom your personal data has been or will be disclosed;
• the planned duration of storage of the personal data concerning you or, if specific details cannot be provided, the criteria used to determine the storage period;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restrict processing by the controller, or a right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information regarding the origin of the data, if the personal data is not collected from the data subject;
• the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended effects of such processing on the data subject.

16.3 Right to Rectification or Erasure (see Art. 16, 17 GDPR)

You have the right to request that we, as the data controller, rectify and/or complete your personal data if the personal data we process concerning you is inaccurate or incomplete. The data controller must carry out the rectification without undue delay.

In addition, you may request the erasure of the personal data concerning you if any of the following grounds apply to you:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
• You object to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
• The personal data concerning you has been processed unlawfully.
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you was collected in connection with information society services offered pursuant to Article 8(1) of the GDPR.

If we have made the personal data concerning you public and are obligated to erase it pursuant to Article 17(1) of the GDPR, we will take all reasonable steps to inform other data controllers that you have requested the erasure of all links to such personal data or of copies or replicas of such personal data.

The right to erasure does not apply if the processing is necessary:

• to exercise the right to freedom of expression and information;
• to comply with a legal obligation that requires processing under Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) of the GDPR, to the extent that the aforementioned right is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
• to assert, exercise, or defend legal claims.

16.4 Right to Restriction of Processing (see Art. 18 GDPR)

Under the following conditions, you may request that we restrict the processing of your personal data:

• if you contest the accuracy of the personal data concerning you for a period that allows us to verify the accuracy of your personal data;
• the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;
• we no longer need the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims; or
• if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether our legitimate grounds override your interests.

If the processing of your personal data has been restricted, such data—with the exception of its storage—may be processed only with your consent or for the purpose of asserting, exercise, or defense of legal claims; to protect the rights of another natural or legal person; or for reasons of a substantial public interest of the Union or a Member State.

If the restriction on processing has been imposed in accordance with the above conditions, we will notify you before the restriction is lifted.

16.5 Right to Notification (see Art. 19 GDPR)

If you have exercised your right to rectification, erasure, or restriction of data processing with us, we are obligated to notify all recipients of your personal data of the rectification, erasure, or restriction of data processing. This applies only to the extent that such notification is not impossible or would involve a disproportionate effort.

You have the right to know which recipients have received your data.

16.6 Right to Data Portability (see Art. 20 GDPR)

You have the right to receive your personal data from us in a commonly used, machine-readable format so that you may, if necessary, have it forwarded to another controller, provided that

• the processing is based on consent pursuant to Art. 6(1)(a) of the GDPR or Art. 9(2)(a) of the GDPR, or on a contract pursuant to Art. 6(1)(b) of the GDPR, and
• the processing is carried out by automated means.

When exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller, to the extent that this is technically feasible.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

16.7 Right to Object to Processing (see Art. 21 GDPR)

To the extent that we base the processing of your personal data on a legitimate interest on our part (pursuant to Art. 6(1), first sentence, lit. f) of the GDPR), you may object to such processing. The same applies if we base the data processing on Article 6(1), first sentence, (e) of the GDPR.

If you exercise such a right to object, we ask that you explain the reasons why we should not process your personal data in the manner we have been doing. In the event of a justified objection, we will review the circumstances and either cease or adjust the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.

16.8 Right to File a Complaint with the Competent Supervisory Authority (see Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your workplace, or the location of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The supervisory authority to which the complaint was submitted will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

17. How to Exercise These Rights

To exercise these rights, please contact our Data Protection Officer:

Christian Scholtz of WS Datenschutz GmbH

consultingheads@ws-datenschutz.de

or by mail:

WS Datenschutz GmbH
Dircksenstraße 51
D-10178 Berlin

18. Reservation of the Right to Amend

We reserve the right to amend this Privacy Policy in accordance with applicable laws.

As of October 2026

Privacy Policy for Our Social Media Presence

Joint Controllers

consultingheads GmbH
Borsigstr. 1, 51381 Leverkusen
Phone: +49 2171 7954780
Email: info@consultingheads.com
Website: consultingheads.com

operates the following social media accounts:

• LinkedIn: consultingheads on LinkedIn
• Facebook: consultingheads on Facebook
• Instagram: consultingheads on Instagram

To do so, we use the services of the following providers:

• LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”)
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Facebook”, “Instagram”)

According to the European Court of Justice ruling of June 5, 2018 (CJEU judgment in Case C-40/17), the operators of social media pages and the social media platforms themselves are jointly responsible for data processing (Art. 26 GDPR). The platform operators provide the necessary agreements for this in their terms of use for page operators.

Please note that you use our social media pages and their features on your own responsibility. This applies in particular to interactive features (e.g., commenting, sharing, rating). The information we provide on social media can also be found on our website.

Data Protection Officer

Our Data Protection Officer is Christian Scholtz of WS Datenschutz GmbH. You can contact him at consultingheads@ws-datenschutz.de or by mail: WS Datenschutz GmbH, Dircksenstraße 51, D-10178 Berlin.

You can contact the data protection officers of the platform operators here:

• LinkedIn: LinkedIn data protection officer contact form
• Facebook and Instagram: Facebook contact form for data protection requests

Data Processed by the Social Networks

When you visit our social media pages, the operators collect, among other things, your IP address and other information stored on your device in the form of cookies. The operators use this information to provide us with statistical analyses regarding the use of our pages. The data is processed by the operators and may be transferred to countries outside the European Union. The operators describe what information they receive and how they use it in their privacy policies:

• LinkedIn: LinkedIn privacy policy
• Facebook: Facebook Page Insights information, Facebook privacy policy
• Instagram: Instagram help article on data protection, Instagram privacy policy

The operators do not fully disclose how they use data from visits to our sites for their own purposes, to what extent activities are attributed to individual users, how long they store this data, or whether it is shared with third parties; we are not aware of this information.

If you are logged in to the respective network, a cookie containing your identifier is stored on your device. This allows the operator to track that you have visited our site and how you used it, and to tailor content or advertising accordingly. If you wish to avoid this, log out before visiting, disable the “stay logged in” feature, and delete any existing cookies. You can find out how to manage or delete your information within the network on the respective network’s help pages.

Data Processed by Us

We process the data you enter on social networks—in particular, your username and the content published under your account—to the extent that we respond to your messages, comments, or mentions. If you “Like” our page, “Follow,” or engage in a similar interaction, the respective network will notify us of this along with your username and a link to your profile. If you mention us (e.g., with @ or #), this mention may appear on our page under your username.

In addition, we reach out to potential candidates via LinkedIn Messages regarding suitable projects. To do so, we use the information publicly visible on your LinkedIn profile, such as your name, title, location, qualifications, and work experience. You can schedule an interview exclusively through our booking tool, HubSpot Meetings (see Section 9.1). We do not store your application documents until you apply through our job board or send us your documents; in doing so, we obtain your consent (see Section 5).

Legal Basis for Processing

Our data processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in communicating with customers, prospects, and candidates; in increasing awareness of our company; and in reaching out to suitable experts for projects.

Purpose of Processing

We process the data you provide to us in this context (e.g., username, photos, interests, contact information) exclusively for the purpose of communicating with you and reaching out to you regarding suitable projects.

Duration of Storage

Your data will be deleted as soon as it is no longer necessary for the stated purposes, or, at the latest, when our respective social media presence is discontinued, to the extent possible. Statutory retention requirements remain unaffected.

Your Rights and How to Exercise Them

You are entitled to the rights described in Section 16. In cases of joint responsibility, you may exercise these rights both with us (contact information above and in Section 17) and with the respective platform operator. You can also find further information on the protection of your data on social networks at youngdata.

Reservation of the Right to Amend

We reserve the right to amend this Privacy Policy in accordance with applicable laws.

As of October 2026