Information on data processing
on the use of the klug-executivesearch.de website and with regard to recruiting procedures

Status 10.07.2024

We are pleased that you have visited our website and would like to inform you here about the potential data processing on our website.

1. Responsible Party

In accordance with Article 4(7) of the General Data Protection Regulation (GDPR), the data controller responsible for the processing of data is:

Klug Personalmanagement GmbH & Co KG
Chausseestraße 103
10115 Berlin, Germany
Phone: +49 (0)30 847 10 86 0
Email: buero@klug-personal.de

(hereinafter referred to as “Klug Personalmanagement”),
represented by Klug Personalmanagement Verwaltungs GmbH, with the managing director Nicole Klug.

2. Extent of Data Protection

Personal data, as defined in Article 4(1) of the General Data Protection Regulation (GDPR), refers to any information that relates to an identified or identifiable individual. This includes, but is not limited to, identifiers such as names, postal addresses, email addresses, and telephone numbers. Additionally, personal data may encompass usage data, such as IP addresses, as well as content data, including documents like your curriculum vitae (CV) or other professional materials.

3. Extent and Purpose of Data Collection and Storage

In the following sections, we outline the scope of data collection, storage, and usage (hereinafter referred to as “data processing” as defined under Article 4(2) of the GDPR), as well as the purposes for which such data processing is carried out:

1. Website Data Processing: Details regarding data processing in the context of website usage (Sections 4 and 5).
2. Customer and Prospective Customer Data Processing: Information on the processing of data related to customers and prospective customers (Section 6).
3. Recruiting Procedures: The scope and purpose of data processing in relation to recruitment procedures (Section 7).
4. Third-Party Services: Data processing considerations involving third-party services, including social media profiles.

4. Data Processing in Relation to the Use of the Website klug-executivesearch.de

In principle, it is possible to use the website without providing personal data. One exception is the IP address. We require this for a short period of time (please read section 4.1).

4.1 IP addresses

The functionality of the Internet relies fundamentally on Internet Protocol addresses, commonly known as “IP addresses.” An IP address acts as a unique identifier that facilitates the routing of data between web servers and individual devices within computer networks. Without IP addresses, communication between web servers and devices would be impossible, making data transmission and website functionality unfeasible.

When you access our website, your device sends a data request to the web server, which requires your IP address to process and fulfill the request. Consequently, the web server must process your IP address to deliver the requested data.

The processing of IP addresses is legally justified under Article 6(1)(b) GDPR, as it is necessary for providing and maintaining access to the website and its content. Furthermore, IP addresses are logged and stored to monitor and secure our IT infrastructure, including the detection of errors and potential unauthorized access. The legal basis for this storage is our legitimate interest in ensuring a secure and functional IT environment, as outlined in Article 6(1)(f) GDPR.

4.2 Handling of Data in Response to Customer or Interested Party Inquiries via Contact Form or Email

When you reach out to us as a customer or interested party (applicant data is addressed in Section 6) via our web form or email, we typically process the following information:

• Email address
• First name and surname
• Telephone number, if provided
• The nature of your request
• Any accompanying documents

This data is processed to address and respond to your inquiry. The processing of this data is carried out solely for the purpose of handling your request. The legal basis for this data processing is Article 6(1)(b) GDPR, which pertains to the necessity of processing personal data to fulfill a contractual or pre-contractual obligation.

5. Data Processing within the Referral Program

Both our employees and external individuals have the opportunity to recommend job vacancies we advertise and can qualify for an incentive if their recommendation is successful, according to the criteria of our referral program.

To participate in the referral program and be eligible for the incentive, the referrer must provide their own contact details along with the name and contact details of the recommended individual. It is essential that the referrer obtains prior consent from the recommended individual to share their data and confirms that this consent has been secured. The processing of this data for the referral program is based on Article 6(1)(a) GDPR, which covers data processing based on the data subject’s consent.

In the event of a successful referral, a non-employee referrer will need to provide their bank account details to receive the incentive. The processing of this bank account information is conducted under Article 6(1)(b) GDPR, which relates to the necessity of processing personal data for the performance of a contract.

6. Data Processing in Recruitment Processes

In the sections below, we will outline the extent of data collection and storage, as well as its utilization and the purpose of data processing in relation to recruiting procedures.

6.1 Data Processing within the Referral Program

Klug Personalmanagement functions as a service provider for recruitment and temporary employment agencies. When you contact us regarding a career transition, we process the data you provide as a candidate. The typical data categories processed include:

• First name and surname
• Postal address
• Date of birth
• Email address(es)
• Telephone number(s)
• Data related to professional qualifications, such as:
• CV data (often including a photo)
• Certificates
• Proof of professional and academic qualifications and other credentials
• Job references
• Other references

The legal basis for this processing is Article 6 (1) (b), in conjunction with Art. 88 GDPR and Art. 26 BDSG, as the processing aims to establish an employment relationship with one of our clients.

If no suitable match is found, and provided you have given your consent, we will include you in the Klug Personalmanagement “talent pool.” This allows us to contact you with potential career opportunities in the future.

6.2 Processing of Candidate Data for Active Recruitment and Direct Placement (Sourcing Procedures)

Klug Personalmanagement engages in active recruitment, commonly referred to as “sourcing procedures,” whereby we actively seek potential candidates through social networks, forums, or other publicly accessible platforms, particularly online. During these sourcing procedures, Klug Personalmanagement processes data that is clearly available to the public, including:

• First name and surname
• Data on professional qualifications
• Email address(es)
• Social media profiles
• Telephone number(s), if applicable

The legal basis for this data processing is Article 6(1)(f) in conjunction with Article 9(2)(e) GDPR. This processing is justified by the legitimate interest in using personal data of potential candidates that has been publicly disclosed by the candidates themselves for recruitment purposes. There is no overriding interest preventing Klug Personalmanagement from utilizing such data, as it pertains to information voluntarily shared by individuals in the social sphere. Furthermore, this data is retained only for the duration specified in the deletion periods (15 months, see Section 8.3).

Data will only be retained beyond this period if explicit consent has been obtained from the data subject.

Candidates whose data is processed as part of an active recruitment process for the talent pool but who are not ultimately approached for the specific position will have their data deleted after 15 months (see Section 8.3). Due to the disproportionate effort involved, such candidates will not be individually notified; however, they will be informed about the data processing carried out at this stage (Article 14(5)(b) GDPR).

7. Transfer of Data to Third Parties

7.1 Processors

In addition to Klug Personalmanagement, your data is also shared with our service providers, specifically IT-Risch GmbH, zvoove Software Germany GmbH, and our hosting provider IONOS SE (Montabaur). We have established data processing agreements with these service providers to ensure that they process your data exclusively in accordance with our instructions and under our strict control.

7.2 Customers/employers

Klug Personalmanagement will disclose personal data to third parties solely under the following conditions:

• Explicit Consent: Personal data will be shared with third parties only if the applicant has provided explicit consent for such disclosure.
• Legal Obligation: Disclosure will also occur if there is a legal obligation to do so.

To safeguard your legitimate interests, personal data will not be transmitted to any specific client without your prior consent. Any transfer of personal data to third parties outside the described scope will require your express consent.

7.3. other third parties
Personal data will be transmitted to state institutions and authorities authorized to receive such information solely under the following conditions:

• Statutory Duty: Disclosure will occur in accordance with our statutory duty to provide information.
• Court Order: Transmission will also be carried out if we are compelled to provide information by a court decision.

8. Duration of Processing and Data Deletion

8.1 Data Retention Periods Related to Website Usage

Data stored in log files will be deleted no later than seven days after its creation. If retention beyond this period is necessary, the IP addresses of users will be anonymized to prevent identification of the accessing client. Additionally, all cookies and other information stored in the browser’s local storage will be deleted upon closing the browser.

8.2 Data Deletion Periods for Customer and Prospective Customer Data in Accordance with Section 4.3

Customer data will be retained for a period of up to 10 years in compliance with the statutory retention periods stipulated in Section 257 (4) of the German Commercial Code (HGB) and Section 147 (3) of the German Fiscal Code (AO). This retention period commences at the end of the calendar year in which the data was collected.

Data concerning interested parties will be deleted four years following the last point of contact, unless statutory retention periods under commercial law as per Section 257 HGB apply. In such cases, data will be used solely to fulfill the retention obligation in accordance with Article 18 GDPR and will be deleted upon expiration of the aforementioned periods. This retention period also begins at the end of the calendar year in which the data was collected.

8.3 Data Retention Periods in the Context of Recruitment Procedures as per Section 6

Upon completion of an application process, data related to applicants who were not selected for the position will be deleted 15 months after the receipt of their application.

Data collected from sourcing procedures will be deleted 15 months after the commencement of the sourcing process, unless further processing is authorized by the data subject’s consent.

Data of applicants introduced to our clients will be retained for a minimum of 12 months following the introduction to substantiate our services, after which it will be deleted.

If you consent to being included in the Klug talent pool, your data will be retained for three years from the date of consent. Before this three-year period expires, we may contact you to renew your consent. Should you choose not to renew your consent, your data will be deleted after the three-year period concludes. Regardless of your consent status, you retain the rights outlined in Section 10.

9. Rights of Data Subjects (Including Access, Rectification, Objection, and Deletion)

As the data subject, you possess the following rights in relation to Klug Personalmanagement as the data owner:

You have the right to request information regarding the processing of your data by us.

You may object to the processing of your data at any time, provided the conditions set forth in Article 21 of the GDPR are met. Additionally, you may revoke any previously given consent to data processing at any time. Such revocation or objection does not affect the legality of data processing conducted prior to the revocation or objection.

You may request that your data be corrected, restricted, or deleted at any time. Please be aware that there may be legal obligations, such as retention requirements, that necessitate the continued storage of data. In such cases, the data will be restricted and only processed to fulfill these legal obligations, and not used for any other purposes.

You have the right to data portability as outlined in Article 20 of the GDPR.

You also have the right to lodge a complaint with a supervisory authority, as provided under Article 77 of the GDPR. For example, you may contact the supervisory authority responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information, located at Friedrichstr. 219, 10969 Berlin.

For any inquiries regarding data protection, please contact us at buero@klug-personal.de.