If you have given your consent, Google Analytics 4, a web analytics service of Google LLC, is used on this website. Our contractual partner is the European subsidiary Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Google Analytics uses cookies that enable an analysis of your use of our websites. The information generated by the cookies about your use of this website is usually transmitted to a Google server in the USA and stored there.

In Google Analytics 4, IP address anonymisation is activated by default. Due to IP anonymisation, your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

During your visit to the website, your user behaviour is recorded in the form of "events". Events can be:

• page views
• first visit to the website
• start of the session
• your "click path", interaction with the website
• scrolls (whenever a user scrolls to the end of the page (90%)), clicks on external links, internal search queries
• interaction with videos, file downloads
• ads viewed/clicked
• language setting
• your approximate location (region), your IP address (in truncated form), technical information about your browser and the devices you use (e.g. language setting, screen resolution), your internet provider
• the referrer URL (via which website/advertising medium you came to this website)
• Google uses this information on our behalf to evaluate your pseudonymous use of the website and to compile reports on website activity (analysis using the User ID is not pseudonymous). The reports provided by Google Analytics are used to analyse the performance of our website.

Recipients of your data:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)

Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Where data is processed outside the EU/EEA and there is no level of data protection equivalent to the European standard, Google Ireland Limited has concluded EU standard contractual clauses with Google LLC, which is based in California, USA, in order to provide appropriate safeguards pursuant to Art. 46 GDPR. A copy of the contractual clauses can be found here: https://policies.google.com/privacy/frameworks?hl=en. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. From a data protection perspective, the USA is currently considered a third country. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.

The data we send that is linked to cookies is automatically deleted after 14 months.

Data whose retention period has been reached is deleted automatically once a month.

The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website and changing your selection there. There you will also find information about the cookies processed. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

You can also prevent cookies from being stored in the first place by adjusting your browser software settings accordingly. However, if you configure your browser to reject all cookies, this may restrict functionality on this and other websites. You can also prevent the data generated by the cookie and relating to your use of the website (including your IP address) from being collected and processed by Google by

1. not giving your consent to the setting of the cookie or
2. downloading and installing the browser add-on to deactivate Google Analytics HERE.

Further information on the terms of use of Google Analytics and on data protection at Google can be found at https://marketingplatform.google.com/about/analytics/terms/gb/ and at https://policies.google.com/?hl=en.

4.5 Web analytics with Segment

To evaluate the use of our website and to assign enquiries in our customer relationship management, we use the Segment service (Twilio Inc., 101 Spear Street, 1st Floor, San Francisco, CA 94105, USA). Segment forwards usage data (e.g. pages viewed, truncated IP address, device information, form entries) to our CRM Pipedrive and information about completed enquiries (conversions) to Google Ads (Google Ireland Ltd., Dublin, Ireland) in order to measure the success of our advertising. The legal basis for assigning enquiries in Pipedrive is our legitimate interest (Art. 6(1)(f) GDPR); for conversion measurement in Google Ads, it is your consent (Art. 6(1)(a) GDPR). Twilio Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses also apply.

4.6 LinkedIn Analytics and LinkedIn Ads

On our website we use the conversion tracking technology and the retargeting function of LinkedIn Inc. Our contractual partner is the European subsidiary LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"). This technology enables personalised advertisements to be shown to visitors of this website on LinkedIn. It is also possible to create anonymous reports on the performance of the advertisements and information on website interaction. For this purpose, the LinkedIn Insight Tag is integrated on this website, which establishes a connection to the LinkedIn server if you visit this website while logged into your LinkedIn account.

LinkedIn is thus informed that you have visited our website, and your IP address is also collected. Timestamps and events such as page views are also stored. This allows us to find out, for example, which LinkedIn ad or interaction on LinkedIn brought you to our website.

This enables us to better control the delivery of our advertising. LinkedIn conversion tracking records when you perform an action on our website. Such actions include, for example, a registration, a search, a lead, a contact, a purchase process and a completed purchase.

Due to the marketing tools used, your browser automatically establishes a direct connection with the LinkedIn server. We have no influence on the scope and further use of the data collected by LinkedIn through the use of the Insight Tag.

Recipients of the data are, in addition to us, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland and, where applicable, LinkedIn Corp., 1000 W Maude Ave., Sunnyvale, CA, 94085-2810, USA.

Where data is processed outside the EU/EEA and there is no level of data protection equivalent to the European standard, LinkedIn Ireland Unlimited Company has concluded EU standard contractual clauses with LinkedIn Inc., which is based in California, USA, in order to provide appropriate safeguards within the meaning of Art. 46 GDPR. A copy of the EU standard contractual clauses can be found here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914.

A transfer of data to the USA and access by US authorities to the data stored by LinkedIn cannot be ruled out. From a data protection perspective, the USA is currently considered a third country. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.

The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website and changing your selection there. There you will also find information about the cookies processed. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

Further information on data collection and use as well as your options and rights to protect your privacy can be found in LinkedIn's privacy policy at www.linkedin.com/legal/privacy-policy

If you are logged into LinkedIn, you can deactivate data collection at any time using the following link:

www.linkedin.com/help/linkedin/answer/1569

4.7 Google Ads

We use Google Ads, an online advertising programme of Google LLC, on our website. Our contractual partner is the European subsidiary Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

This involves so-called conversion tracking. If you click on an ad placed by Google, a cookie is set. This cookie expires after 30 days and is not used to identify users personally. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the ad and was redirected to this page.

The data obtained using the conversion cookie is used to compile statistics for Ads customers who have opted in to conversion tracking.

Recipients of your data:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Where data is processed outside the EU/EEA and there is no level of data protection equivalent to the European standard, Google Ireland Limited has concluded EU standard contractual clauses with Google LLC, which is based in California, USA, in order to provide appropriate safeguards within the meaning of Art. 46 GDPR. A copy of the contractual clauses can be found here: https://policies.google.com/privacy/frameworks?hl=en. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. From a data protection perspective, the USA is currently considered a third country. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.

The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website and changing your selection there. There you will also find information about the cookies processed. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

You can also prevent cookies from being stored in the first place by adjusting your browser software settings accordingly. However, if you configure your browser to reject all cookies, this may restrict functionality on this and other websites. You can also prevent the data generated by the cookie and relating to your use of the website (including your IP address) from being collected and processed by Google by

1. not giving your consent to the setting of the cookie or
2. downloading and installing the browser add-on to deactivate Google Analytics HERE.

Further information on the terms of use of Google Ads and on data protection at Google can be found at https://ads.google.com/home/ and at https://policies.google.com/?hl=en.

4.8 Meta Pixel

We use the "Meta Pixel" of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") on our website. The pixel allows us to measure whether users visit our website after viewing or clicking on an advertisement on Facebook or Instagram and, for example, submit an enquiry there (conversion measurement), and to show visitors to our website interest-based advertising on these platforms (Custom Audiences). For this purpose, your browser establishes a connection to Meta's servers. In particular, your IP address, browser and device information, the pages viewed, timestamps and cookie identifiers (e.g. "_fbp") are processed. If you are logged into Facebook or Instagram, Meta can associate the visit with your user account.

We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR). The essence of the arrangement can be found at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. In this context, data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website and changing your selection there. Further information can be found in Meta's privacy policy at https://www.facebook.com/privacy/policy.

4.9 Microsoft Advertising

On our website we use the conversion measurement ("Universal Event Tracking") of Microsoft Advertising, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland ("Microsoft"). Cookies are stored on your device (e.g. "_uetsid", "_uetvid"), which record whether you came to our website via an ad on the Bing search engine or in Microsoft's advertising network and which actions you take here (e.g. a contact enquiry). This allows us to measure the success of our advertising and to show ads to visitors to our website again (remarketing). In particular, your IP address, device and browser information, the pages viewed and timestamps are processed.

In this context, data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website and changing your selection there. Further information can be found in Microsoft's privacy statement at https://privacy.microsoft.com/en-gb/privacystatement.

4.10 Microsoft Clarity

To analyse and improve our website, we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited (address see section 4.9). Clarity records how visitors use our website, e.g. clicks, mouse movements, scroll depth and time spent, and uses this to create heatmaps and pseudonymous recordings of individual sessions (session replays). According to Microsoft, entries in form fields are masked by default. Clarity sets cookies (e.g. "_clck", "_clsk") and processes in particular your IP address, device and browser information and the pages viewed.

In this context, data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website and changing your selection there. Further information can be found at https://learn.microsoft.com/en-us/clarity/setup-and-installation/privacy-disclosure.

4.11 OpenAI Measurement Pixel (advertising in ChatGPT)

We place advertisements in ChatGPT and use OpenAI's "Measurement Pixel" to measure their success. For users in the European Economic Area, the provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI"). If you come to our website via an ad in ChatGPT, the pixel stores a click identifier in a cookie (e.g. "__oppref"). If you then take certain actions (e.g. a contact enquiry), the pixel transmits these events to OpenAI together with the identifier, timestamps and page and device information. This allows us to measure whether our ads lead to enquiries.

OpenAI processes this data as an independent controller; in this context, data may be transferred to OpenAI, L.L.C. in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website and changing your selection there. Further information can be found in OpenAI's privacy policy at https://openai.com/policies/privacy-policy/.

4.12 Protection against spam and abuse (Cloudflare Turnstile)

To protect our forms against spam and automated access (bots), we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When a form is opened or submitted, Turnstile uses technical characteristics (e.g. IP address, browser and device information, interaction data) to check whether the entry comes from a human. The data is processed exclusively for this purpose.

The legal basis is our legitimate interest in protecting our website against abuse and spam (Art. 6(1)(f) GDPR); insofar as information is stored on or read from your device, this is strictly necessary for the service you have requested (Section 25(2) No. 2 TDDDG). Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. Further information can be found at https://www.cloudflare.com/privacypolicy/.

5. General contact

You can contact us via the contact form on our website, by email, telephone or letter. The information from your enquiry, including the contact details you provide, is stored by us exclusively for the purpose of processing the enquiry and in the event of follow-up questions. The data is not passed on to third parties in this context.

The legal basis for processing the data is Art. 6(1)(f) GDPR. Our interest in responding to your enquiry outweighs your interest; as you are writing to us, a response is also in your interest and you are aware that we need to process your data in order to respond to your enquiry.

If the email contact aims at the conclusion of a contract, the legal basis for the processing is Art. 6(1)(b) GDPR.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. This is the case when the respective conversation with the user has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

6. Additional information on communicating with us

The following information applies to any communication with us. If the communication takes place within a contractual relationship, the data processing is also governed by the additional information in section 7 (Additional information for contractual partners).

6.1 Telephone

You can contact us by telephone.

Information processed & duration of processing

In addition to your telephone number, we process the personal data that you provide to us during the call. The data is deleted – unless there is another reason for processing – as soon as your matter has been resolved.

Purpose of processing & legal basis

The personal data is processed exclusively for the purpose of handling the enquiry and in the event of follow-up questions. If the communication aims at the conclusion of a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not outweigh our interest in responding to your enquiry; as you are calling us, a response is also in your interest and you are aware that we need to process your personal data in order to respond to your enquiry.

6.2 Email

You can contact us by email. Please note that third parties may be able to gain insight into email communication. If it is important to you that the information you provide is not exposed to the risk of unlawful access by third parties, we therefore recommend using a different means of communication. However, if you contact us by email, we assume that further exchanges via this channel are also in your interest.

Information processed & duration of processing

In addition to your email address, we process the personal data that you provide to us in the email communication. The data is deleted – unless there is another reason for processing – as soon as your matter has been resolved.

Purpose of processing & legal basis

The personal data is processed exclusively for the purpose of handling the enquiry and in the event of follow-up questions. If the communication aims at the conclusion of a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. In all other cases, Art. 6(1)(f) GDPR is the legal basis. Your interest does not outweigh our interest in responding to your enquiry; as you are writing to us, a response is also in your interest and you are aware that we need to process your personal data in order to respond to your enquiry.

6.3 Video calls and transcription

We also use video calls for communication. If you have given us your consent, we create a transcript (verbatim record) of the video conference. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future by informing the person you are talking to or by email to the contact address given above.

We delete the recording after the transcript has been created, at the latest after 30 days.

Recipients of your data:

To conduct video calls, we use the "Google Meet" service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as our processor. We have concluded a data processing agreement with the processor. The processor may process personal data in the USA through its parent company Google LLC in order to ensure smooth video calls. Google LLC processes the data in the USA on the basis of an EU adequacy decision in conjunction with certification under the EU-U.S. Data Privacy Framework.

We also use Google Meet for recording and transcription.

6.4 Appointment booking with Cal.eu

For booking appointments online, we integrate the appointment booking service Cal.eu, a service of Cal.com, Inc., USA, on our website. According to the provider, the data is stored and processed exclusively in the EU. When you book an appointment, we process the data you enter (e.g. name, email address, desired appointment, your message if applicable) and technical connection data (e.g. IP address) in order to arrange and hold the appointment. The legal basis is Art. 6(1)(b) GDPR insofar as the booking serves to initiate a contract, and otherwise our legitimate interest in simple appointment scheduling (Art. 6(1)(f) GDPR). We hold the meetings themselves via Google Meet (see section 6.3). The booking data is deleted as soon as it is no longer required for scheduling and no statutory retention obligations apply.

7. Additional information for contractual partners

The following information also applies to you if we have a contractual relationship with each other or are in the process of initiating one.

Information processed & duration of processing

Which of your data is processed in detail depends on the tasks within the contractual relationship. We use personal information exclusively for the purpose for which it was provided to us. This includes, for example, personal details (name, address and other contact details, date and place of birth). It may also include order data (e.g. payment order), data from the performance of our contractual obligations (e.g. turnover data in payment transactions), information about your financial situation (e.g. creditworthiness data), advertising and sales data and other data comparable to the categories mentioned. The personal data is deleted as soon as the contractual relationship with you has ended and there is no other reason for processing.

Purpose of processing & legal basis

Processing is carried out primarily for the purpose of establishing and performing the contractual relationship; the legal basis is Art. 6(1)(b) GDPR. In addition, we also process some of your data on the basis of our legitimate interest, namely for the purposes of contact and communication management, cost-effectiveness controls, contract and project management and to ensure the operation of information and telecommunications systems. The legal basis is Art. 6(1)(f) GDPR. As a company, we are also bound by various legal obligations that must be complied with on the basis of applicable laws and regulations. The legal basis for processing to comply with legal requirements and obligations is Art. 6(1)(c) GDPR. These include, for example, retention obligations under tax law.

8. Additional information on data processing on our social media channels

We maintain company profiles on various social media platforms in order to provide information about our services and activities and to communicate with interested parties, users and customers. We are currently present on LinkedIn, Instagram, Facebook and Xing.

Personal data may be processed in connection with visiting and using our social media channels. This concerns both data that you actively provide (e.g. through comments, messages or reactions) and data that is automatically collected by the respective platform operators.

Information & duration of processing

When you visit or interact with our social media pages, personal data is processed by the respective platform operators under their own data protection responsibility. Please refer to the privacy notices of the respective platform for information on this.

The operators of Facebook and Instagram (Meta Platforms Ireland Limited, hereinafter "Meta"), LinkedIn (LinkedIn Ireland Unlimited Company, hereinafter "LinkedIn") and Xing (New Work SE, hereinafter "Xing") also provide us with statistical evaluations of the use of our company pages (so-called "Page Insights"). We only receive aggregated and anonymised information about the use of our pages, for example about reach, interactions or visitor groups. In connection with Page Insights, we process your personal data together with Meta, LinkedIn and Xing respectively as joint controllers within the meaning of Art. 26 GDPR.

If you communicate with us via direct messages on our social media channels, we process the information you provide. This may include in particular your user name, your profile name, your contact details and the content of your message.

The storage period of the processed data is generally determined by the requirements of the respective platform operators. Data processed by us in the context of communication is deleted as soon as the respective purpose of processing no longer applies and no statutory retention obligations prevent deletion.

Purpose of processing & legal basis

Personal data is processed on our social media channels in order to provide information about our company, to communicate with users, to answer enquiries and to improve the reach and attractiveness of our online presence.

Where we process messages, comments or other content, this is done on the basis of our legitimate interest in communicating with users pursuant to Art. 6(1)(f) GDPR.

Page Insights at Meta, LinkedIn and Xing are processed in order to evaluate the use of our social media presences and to optimise them in line with users' interests. The legal basis for this is Art. 6(1)(f) GDPR. We have concluded a joint controller arrangement with Meta, LinkedIn and Xing, which you can access here:

• Meta: https://www.facebook.com/legal/terms/information_about_page_insights_data
• Xing: https://www.xing.com/terms/onlyfy-one
• LinkedIn: https://www.linkedin.com/legal/l/page-joint-controller-addendum

In principle, you can exercise your data subject rights both against us and directly against the respective platform operator. However, as the platform operators have direct access to the processed data, contacting them directly is often the most effective way to exercise your rights.

For the processing of personal data in connection with Page Insights, the lead supervisory authority for Meta and LinkedIn is the Irish Data Protection Commission and for Xing (New Work SE, Hamburg) the Hamburg Commissioner for Data Protection and Freedom of Information.

9. Additional information on candidate search, recruitment services and our recruiting platform

As a recruitment services provider, we search for suitable candidates for our clients. For this purpose, we use a recruiting platform. Below we inform you about the processing of your personal data in connection with our recruitment services and our recruiting platform:

9.1 Joint controllership of the CareerTeam Group

The companies of the CareerTeam Group use a shared recruiting platform and are joint controllers for the processing in recruiting (Art. 26 GDPR). These are the following companies:

• CTG Consulting GmbH (with the brands Scalable Talent and Findus Finds),
• CareerTeam GmbH (with the brand Benomik),
• PALTRON GmbH, Numeris Consulting GmbH,
• Sinceritas GmbH,
• alphacoders GmbH and
• Foxio Consulting GmbH,

each at Am Sandtorkai 48, 20457 Hamburg, Germany, and

• CareerTeam Schweiz GmbH, Weinplatz 10, 8001 Zurich, Switzerland.

Each company provides the information pursuant to Art. 13 and 14 GDPR and ensures the lawfulness of its processing. You can exercise your rights against any of the companies involved. The companies forward your request to each other. Personal data breaches are reported by the company in whose area the breach occurred, and in case of doubt by CTG Consulting GmbH.

9.2 Candidate search and contact

We process your contact details (name, email address) for the purpose of contacting you or, after receipt of your unsolicited application, for the purpose of carrying out the application process. This may include personal data that we have lawfully obtained from publicly accessible sources or personal contacts (e.g. from joint communication in a professional social network such as XING or LinkedIn). Where permitted, we may also process information on career changes, in particular changes of employer, in order to draw your attention to interesting positions at a suitable time.

The legal basis for this is our overriding legitimate interest in targeted communication with potential applicants via professional social networks (Art. 6(1)(f) GDPR).

We only contact you via WhatsApp with your prior express consent (Art. 6(1)(a) GDPR). WhatsApp is provided by WhatsApp Ireland Limited (Ireland); in this context, data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework.

Source of your data

Where we have not received your personal data directly from you, it comes from publicly accessible sources, in particular from professional social networks, company websites, personal websites, publicly accessible profiles or from providers of professional profile data.

Recipients of your data

We use Mailgun to send portal invitations, login links and transactional emails. Mailgun is provided by Mailgun Technologies, Inc. (USA). We have concluded a data processing agreement with Mailgun. It cannot be ruled out that personal data will be transferred to the USA. Appropriate safeguards pursuant to Art. 46 GDPR are used to protect your data. Further information on data protection at Mailgun can be found in its privacy policy at https://www.mailgun.com/legal/privacy-policy/

9.3 Use of the recruiting platform

To carry out the application process, we send you a personal invitation link to our recruiting platform by email. On the platform, you can access information about the position, upload documents, book appointments and send us messages. We also enrich your information with publicly available professional profile data. We also process personal data that you provide to us, e.g.:

• master data (surname, first name, name affixes and date of birth)
• contact details (address, email, telephone number)
• any other information you provide voluntarily
• documents sent to us and their content (e.g. cover letter, CV, references, certificates of employment, residence permit, work permit).

We process your data to carry out the application process on the legal basis of Art. 6(1)(b) GDPR.

If you voluntarily provide special categories of personal data, for example information about a severe disability, the processing is based on your consent pursuant to Art. 9(2)(a) GDPR.

If you are selected for a position with a client company, we will only transfer your data to the respective client with your prior consent. The legal basis is Art. 6(1)(a) GDPR.

Source of your data

Where we have not received your personal data directly from you, it comes from publicly accessible sources, in particular from professional social networks, company websites, personal websites, publicly accessible profiles or from providers of professional profile data.

Recipients of your data

We use Supabase to operate individual applications and databases. Supabase is provided by Supabase, Inc. (USA); the data is hosted in Frankfurt am Main, Germany. We have concluded a data processing agreement with Supabase. It cannot be ruled out that personal data will be transferred to the USA. EU standard contractual clauses have been agreed with Supabase to protect your data. Further information on data protection at Supabase can be found in its privacy policy at https://supabase.com/privacy.

We use Vercel for hosting and the technical operation of individual applications. Vercel is provided by Vercel Inc. (USA). We have concluded a data processing agreement with Vercel. It cannot be ruled out that personal data will be transferred to the USA. EU standard contractual clauses have been agreed with Vercel to protect your data. Further information on data protection at Vercel can be found in its privacy policy at https://vercel.com/legal/privacy-policy.

We use Sentry for technical error analysis and to ensure the functionality of our systems.

Sentry is provided by Functional Software, Inc. (USA). We have concluded a data processing agreement with Sentry. It cannot be ruled out that personal data will be transferred to the USA. EU standard contractual clauses have been agreed with Sentry to protect your data. Further information on data protection at Sentry can be found in its privacy policy at https://sentry.io/privacy/.

We use Bright Data to enrich and retrieve publicly available professional profile data. Bright Data is provided by Bright Data Ltd. (Israel). We have concluded a data processing agreement with Bright Data. Personal data may be processed in Israel as part of the service. There is an adequacy decision of the European Commission for Israel. Further information on data protection at Bright Data can be found in its privacy policy at https://brightdata.com/privacy.

9.4 Video interviews

We may conduct interviews by video conference. With your consent, interviews may be recorded and automatically transcribed in order to document and evaluate the content of the conversation. We obtain and document your consent at the beginning of the conversation. The recordings are deleted after the transcription has been completed, at the latest after 30 days. The transcript remains in your candidate profile.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Recipients of your data:

To conduct video calls, we use the "Google Meet" service of Google Ireland Limited (Ireland) as our processor. We have concluded a data processing agreement with the processor. The processor may process personal data in the USA through its parent company Google LLC in order to ensure smooth video calls. Google LLC processes the data in the USA on the basis of an EU adequacy decision in conjunction with certification under the EU-U.S. Data Privacy Framework.

9.5 AI-supported processing

We use AI systems to make recruiting processes more efficient. This may include in particular the following processing:

• analysis and structuring of CVs and application documents
• evaluation of professional profiles
• mapping of skills to a skills catalogue
• candidate search within the database
• summary of interviews and conversation notes
• matching of candidate profiles with position requirements
• preparation of a fit assessment including a score and justification

The assessments generated in this way constitute profiling within the meaning of Art. 4(4) GDPR.

There is no solely automated decision-making within the meaning of Art. 22 GDPR: whether you are approached or introduced to a client is always decided by a recruiter. The models are not trained with your data.

The legal basis for the processing of your data by the AI is Art. 6(1)(f) GDPR. We have an overriding legitimate interest in processing application documents efficiently. You can object to this processing at any time and request an explanation of the assessment.

Recipients of your data

We use Google Vertex AI and Claude for processing by AI systems.

Google Vertex AI is provided by Google Ireland Limited (Ireland); processing takes place in data centres in the EU. We have concluded a data processing agreement with Google. It cannot be ruled out that your personal data will be transferred to companies of the Google group in the USA. To protect your data, the EU-U.S. Data Privacy Framework currently provides an adequacy decision for data processing by Google USA. Further information on data protection at Google can be found in its privacy policy at https://policies.google.com/privacy?hl=en.

Claude is provided by Anthropic Ireland Limited (Ireland, EU). To ensure that Anthropic processes your data in accordance with our instructions, we have concluded a data processing agreement with Anthropic. Anthropic processes the personal data in the USA. To protect your data, we have concluded EU standard contractual clauses with Anthropic. Further information on data protection at Anthropic can be found in its privacy policy at https://www.anthropic.com/legal/privacy.

9.6 Analysis and optimisation

If you give your consent, we analyse the use of the recruiting platform and test individual functions in order to develop the platform further technically and functionally. Only pseudonymous identifiers are processed.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time in the portal.

Recipients of your data

We use Amplitude to analyse and optimise the use of our recruiting platform. Amplitude is provided by Amplitude, Inc. (USA). We have concluded a data processing agreement with Amplitude. It cannot be ruled out that personal data will be transferred to the USA. EU standard contractual clauses have been agreed with Amplitude to protect your data. Further information on data protection at Amplitude can be found in its privacy policy at https://amplitude.com/privacy.

9.7 Candidate database

If you consent, we will store your candidate profile in our candidate database beyond a specific recruiting process in order to draw your attention to suitable job offers in future and to consider you for further vacancies – including with clients other than the company for which we originally approached you. The recruiting companies of the CareerTeam Group can access the candidate database:

• CTG Consulting GmbH
• CareerTeam GmbH
• PALTRON GmbH
• Numeris Consulting GmbH
• Sinceritas GmbH
• alphacoders GmbH
• Foxio Consulting GmbH

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. Giving your consent is voluntary and has no influence on current or future application processes. You can withdraw your consent at any time with effect for the future.

9.8 Storage period of your application documents

We only store your personal data for as long as is necessary to carry out the recruiting process or as required by statutory retention obligations.

If an employment relationship with one of our clients is established, we store the data required for this until the recruiting process has been completed and beyond that only insofar as this is necessary for contract processing, for evidentiary purposes or due to legal obligations.

If no employment relationship is established, we generally delete your application data six months after the end of the application process, unless there are statutory retention obligations or you have consented to longer storage in our candidate database.

Irrespective of this, we may store individual data for the establishment, exercise or defence of legal claims until the statutory limitation periods have expired. The legal basis is Art. 6(1)(f) GDPR.

10. Additional information for our applicants

The following information also applies to you if you apply to us.

We process the personal data that we receive from you through your application.

The personal data will be deleted after six months if no employment relationship is established and no other legitimate interests of the controller prevent deletion. Another legitimate interest in this sense is, for example, a burden of proof in proceedings under the German General Equal Treatment Act (AGG).

If you have consented to being included in our talent pool, we will delete your data two years after our last contact with you.

If an employment relationship is established, the data will be processed further for this purpose.

We collect and process the personal data of applicants for the purpose of handling the application process.

The legal basis for processing the personal data is Art. 6(1)(b) GDPR. If we conclude an employment contract with you, the data transmitted will be processed further for the purpose of handling the employment relationship; in this case, the legal basis remains in particular Art. 6(1)(b) GDPR.

If we process the application data beyond six months with your consent, this is done on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future in accordance with Art. 7(3) GDPR.

Last updated: November 2026