Privacy Policy

1. Introduction and general information

Thank you for your interest in our website. The protection of your personal data is very important to us. In the following, you will find information on how we handle your data that is collected through your use of our website. Your data will be processed in accordance with the legal regulations on data protection.

a) Controller according to the GDPR

TALENTspy GmbH
Ludwigstrasse 9
D-80539 Munich
Tel.: +49 (89) 480 582 – 0
Fax: +49 (89) 480 582 – 22

b) Contact information for the Data Protection Officer

DATENDO XL GmbH / www.datendo.de
Data Protection Officer
Frankfurter Allee 108
D-10247 Berlin
dsgvo@datendo.de
When you contact the Data Privacy Officer, please name the company to which your request refers. Please avoid attaching any sensitive information, such as a copy of your ID card, to your request.

c) Definitions

Our Privacy Policy is intended to be simple and understandable for everyone. In this Privacy Policy, the official terms of the General Data Protection Regulation (“GDPR”) are generally used. The official definitions are explained in Art. 4 GDPR.

d) Access and storage of information in end devices

By using our website, information (for example, IP address) may be accessible or information (for example, cookies) may be stored in your end devices. This access or storage may involve further processing of personal data in accordance with the GDPR.
In cases where such access or storage of information is necessary for the technically error-free provision of our services, this will be done based on § 25 (2) No. 2 TDDDG.
In cases where such a process serves other purposes (e.g. the needs-based design of our website), this will only be carried out based on § 25 (1) TDDDG with your consent in accordance with Art. 6 (1) lit. a GDPR. The consent can be withdrawn at any time for the future. The requirements of the GDPR and the German Federal Data Protection Act (BDSG) are applicable regarding the processing of your personal data.
For further information on the processing of your personal data and the relevant legal bases in this context, please refer to the following sections on the specific processing activities on our website.

Details of the cookies and similar technologies we use, their storage period and legal basis are set out in our Cookie Policy. You can change or withdraw your consent there, or via the “Manage consent” tab, at any time with effect for the future.

e) Webhosting

This website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. The servers are located in Germany; no data is transferred to third countries as part of the hosting. Any personal data that is collected on this website is stored on the hoster’s servers. This may include IP addresses, contact requests, meta and communication data, website accesses and other data generated via the website.
We collect the listed data to ensure a proper connection of the website and a technically error-free provision of our services. The processing of this data is necessary to provide you with the website. The legal basis for the processing of the data is our legitimate interest in the correct display and functionality of our website in accordance with Art. 6 (1) lit. f GDPR.
We have signed a data processing agreement with the provider in accordance with the requirements of Art. 28 GDPR, in which we obligate the provider to protect the data of our customers and not to disclose it to third parties.

2. Collection and storage of personal data and the type and purpose of their use

a) During your visit to the website

When you visit our website at www.talentspy.de, the browser used on your end device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automated deletion:

IP address of the requesting computer,
Date and time of access,
Name and URL of the accessed file,
website from which the access was made (referrer URL),
browser used and, if applicable, the operating system of your computer as well as the name of your access provider.

The mentioned data are processed by us for the following purposes:

Ensuring a smooth connection setup of the website,
Ensuring a comfortable use of our website,
evaluation of system security and stability as well as
for other administrative purposes.

The legal basis for the data processing is Art. 6 (1) S. 1 lit. f GDPR. Our legitimate interest follows from the purposes for data collection listed above. In no case do we use the collected data for the purpose of making conclusions about your person.

b) By contacting us by e-mail, mail, telephone, fax and via social media (LinkedIn)

When you contact us by e-mail, post, telephone, fax and via social media (LinkedIn), the data you provide, such as your e-mail address and, if applicable, your name and other contact data, will be stored by us to be able to respond to your request. Under no circumstances will we pass on this data without your consent. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 (1) lit. f GDPR and, if applicable, Art. 6 (1) lit. b GDPR, if your request is intended to conclude a contract. Your data will be deleted after final processing of your request if there are no legal obligations to store data. You can object to the processing of your personal data at any time in the case of Art. 6 para. 1 lit. f GDPR.

c) Executive search, direct approach and applications

As an executive search consultancy, we support companies in filling leadership and key positions. For this purpose, we process personal data of candidates who apply to us, whom we approach directly or who are recommended to us.

Data we process: contact details (name, email address, telephone number), information on your professional background (CV, positions, qualifications, education, language skills, references), information from our conversations with you (for example salary expectations, availability, willingness to change) and our assessment of your suitability for a position. We only process special categories of personal data under Art. 9 GDPR, such as information on health or a severe disability, if you provide it to us yourself and it is necessary for the position.

Where the data comes from: from you, from publicly accessible professional sources, in particular your profile on professional networks such as LinkedIn, from company websites and publications, and from recommendations by third parties.

Purposes: We identify suitable candidates for specific mandates, approach them, conduct interviews and assessments, present them to our clients with their consent and support the process until the position is filled. We also consider you for future mandates (candidate pool).

Legal bases: Research and direct approach are based on our legitimate interest under Art. 6(1)(f) GDPR in finding and approaching suitable people for our clients’ positions. Professional networks exist precisely for this kind of networking and approach. Once you work with us on a specific appointment, we process your data to take steps prior to entering into a contract under Art. 6(1)(b) GDPR. We only present you to a client with your consent under Art. 6(1)(a) GDPR, and for special categories of personal data under Art. 9(2)(a) GDPR. Storage in our candidate pool is based on our legitimate interest under Art. 6(1)(f) GDPR in being able to consider you for suitable future mandates.

Information when we approach you directly: If we do not collect your data from you, we inform you about this processing with our first message to you, and in any case within one month (Art. 14 GDPR).

Recipients: the clients for whose position we present you, and only after your consent. As a processor under Art. 28 GDPR, we use Spott BV, Frederik Lintsstraat 57, 3000 Leuven, Belgium, for our candidate database (privacy policy: spott.io/privacy-policy). In addition, the service providers listed in section 4 and, where AI is used, in section 2 i).

Storage period: We store your data for the duration of the appointment process. After that, it remains stored for future mandates for up to two years after our last contact. Before this period ends, we ask whether you would like to remain in our candidate pool; without your consent, we delete the data. If you do not wish to be included, object or withdraw your consent, we delete your data without undue delay, unless statutory retention obligations apply.

Your rights: You may object at any time to processing based on Art. 6(1)(f) GDPR and withdraw your consent at any time with effect for the future. The lawfulness of processing until withdrawal remains unaffected. An email to info@talentspy.de is sufficient.

d) Consent management (cookie banner)

When you first visit our website, a banner asks whether you consent to technologies that require consent. We use the WordPress plugin Complianz for this. It runs on our own web server, and no data is transferred to the plugin’s developer.

Your choice is stored in cookies in your browser (names beginning with cmplz_). They record which categories you accepted or declined and the version of our cookie policy. The cookies are deleted after 365 days, after which we ask again.

The legal basis for storing these cookies is Section 25(2) no. 2 TDDDG, as they are strictly necessary to respect your choice. Further processing is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, as we must be able to demonstrate that consent has been given.

You can change or withdraw your choice at any time via the “Manage consent” tab at the bottom of the screen or in our Cookie Policy.

e) Web analytics and advertising with Google Analytics 4

If you consent to the “Statistics” category in the cookie banner, we use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The service is integrated via the WordPress plugin Google Site Kit, which runs on our web server.

Google Analytics evaluates how our website is used so that we can improve its content and usability. This involves processing in particular the pages visited, time spent, referring page, device type, browser, operating system, screen resolution and approximate location (country, region). According to Google, IP addresses are not logged or stored in Google Analytics 4. To recognise returning visitors, Google Analytics sets the cookies _ga and _ga_2BK0QHVE5K, each with a lifetime of two years.

We only use advertising features if you also consent to the “Marketing” category. These include Google Signals: if you are signed in to a Google account and have allowed personalised advertising there, Google may analyse your usage across devices and link it with information from your Google account. We only receive aggregated reports, not information about individuals. We may also link Google Analytics with Google Ads in order to build audiences for advertisements and measure their success. We pass your choice in the cookie banner on to Google via Google’s consent mode. Without your consent to “Marketing”, these advertising features are not used for your visit.

User-level data is deleted 14 months after the last visit. We need this period to compare website usage year on year. Data sharing settings with Google are deactivated except for technical support. We have concluded a data processing agreement with Google under Art. 28 GDPR.

Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. An adequacy decision of the European Commission exists for the USA (EU-US Data Privacy Framework, Art. 45 GDPR), under which Google LLC is certified.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without your consent to “Statistics”, Google Analytics is not loaded. You can withdraw your consent at any time with effect for the future via the “Manage consent” tab. You can also switch off personalised advertising in your Google account at adssettings.google.com. You can view and delete the data linked to your Google account at myactivity.google.com (“My Activity”). Further information is available in Google’s privacy policy.

f) Storing your language setting

Our website is available in German and English. So that we can show you your chosen language on your next page view, the WordPress plugin Polylang stores the cookie pll_language with a lifetime of one year. It contains only the language code (de or en). The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is presenting the website in the language you have chosen.

g) View statistics for job advertisements

If you consent to the “Statistics” category in the cookie banner, our job board (WordPress plugin WP Job Manager) counts how often job advertisements and search pages are viewed and how often “Apply” is clicked. So that each view is counted only once, the plugin stores one entry per advertisement in your browser’s local storage, containing only an expiry time 24 hours after the view. The plugin deletes expired entries on a later visit, and you can delete them at any time by clearing your browser storage.

On our server we store only the number of views and clicks per advertisement and day, not who triggered them. To prevent double counting and abusive requests, the plugin creates a hash value from your IP address and stores it for no more than 24 hours. The IP address itself is not stored for this purpose. The data is not transferred to third parties.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time via the “Manage consent” tab.

h) Contact form

You can write to us via a form on our website and optionally attach a file, such as your CV. We process your name, email address, message and the attached file in order to answer your enquiry. The information is stored on our hosting provider’s server (section 1 e) and forwarded by email to info@talentspy.de. To send this notification, we currently use the Gmail email service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or cooperation, otherwise our legitimate interest in answering your enquiry under Art. 6(1)(f) GDPR. If you send us application documents, section 2 c) also applies. We delete the form data on the website once your enquiry has been dealt with, unless statutory retention obligations apply.

i) Use of artificial intelligence applications

We use artificial intelligence (AI) applications in our work to research, structure and summarise information, for example when matching a career profile against the requirements of a position, when preparing interviews or when drafting texts. This may involve processing personal data of candidates, clients and contact persons.

AI supports our consultants. Decisions, such as whether we present you to a client, are always made by people. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

We use Claude, a service provided by Anthropic Ireland, Limited, Ireland. This is based on a data processing agreement under Art. 28 GDPR; under Anthropic’s commercial terms, the content we enter is not used to train its models. Data may also be processed in the USA. The transfer is based on appropriate safeguards under Art. 44 et seq. GDPR, in particular the European Commission’s standard contractual clauses. Further information is available in Anthropic’s privacy policy.

The legal basis is that of the respective processing supported by AI (in particular section 2 c), and additionally our legitimate interest in efficient and careful handling under Art. 6(1)(f) GDPR.

j) Identifying visiting companies with Lusha

If you consent to the “Marketing” category in the cookie banner, we use the Website Visitors feature of Lusha. The providers are Lusha Systems Inc., 800 Boylston Street, Suite 1410, Boston, MA 02199, USA, and Lusha Systems Ltd., 132 Derech Menachem Begin, Tel Aviv 6701101, Israel (“Lusha”).

Lusha matches the IP address of your visit against publicly available company information to identify which company a visit comes from. This involves processing the IP address, the pages viewed, the time and duration of the visit and the referring page (referrer). We only receive information at company level, such as the company’s name, sector and size and the number and duration of visits. We do not identify individual visitors and we do not link visits to individuals. The pages of our job board are excluded from this analysis.

We use this information to understand which companies are interested in our topics and to align our content and business development accordingly. We never base an approach on a visit to our website. The Lusha pixel works on a per-session basis. Lusha deletes identified companies that we have not expressly saved after 90 days.

According to Lusha, the data is stored with Amazon Web Services in the USA, and some processing takes place in Israel. The European Commission has issued an adequacy decision for Israel. For transfers to the USA, Lusha provides the European Commission’s Standard Contractual Clauses.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without your consent to “Marketing”, Lusha is not loaded. You can withdraw your consent at any time with effect for the future via the “Manage consent” tab. Further information can be found in Lusha’s privacy notice.

3. External links

The social network LinkedIn is only integrated on our website as a link. After clicking on the integrated text/image link, you will be redirected to the page of the provider to which you are referring. The user information will only be transferred to the respective provider after the connection has been made. For information on the handling of your personal data by using these websites, please check the privacy policy of the provider you are using.

a) Social media presence

In the following, you will find information about the handling of your data that is collected by our social media presences on social networks and platforms. Your data will be processed in accordance with the legal regulations.

b) Further social media providers

i. Responsible party

If your personal data is processed by a provider listed below, this provider is the controller for data processing within the meaning of the GDPR. For the claiming of your data subject rights, we would like to point out that these can most effectively be asserted with the respective providers. Only they have access to the data collected from you. Should you require assistance, nevertheless, please feel free to contact us at any time.
We have online presences on the social media platforms of the following providers:
• LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

ii. Data Protection Officer
Instructions on how to contact the Data Protection Officer of the other social media providers can be found here:
• LinkedIn Ireland Unlimited Company: https://www.linkedin.com/help/linkedin/ask/TSO-DPO

c) General information about social media platforms

i. Responsible party

The responsible party for data processing within the meaning of the GDPR is the entity named at the beginning of this privacy policy, insofar as data transmitted by you via one of the social media platforms is processed by us ourselves.

ii. Our Data Protection Officer

If you have any concerns about the data processing performed by us as the controller, you can contact our data protection officer using the contact details provided at the beginning of this privacy policy.

iii. General processing of data at the social media platforms; Data processing for market research and advertising

Personal data is usually processed on the company website for market research and advertising purposes. For this purpose, a cookie is set in your browser, which enables the respective provider to recognize you when you visit a website. By means of the collected data, usage profiles can be created. These are used to display advertisements within and outside the platform that presumably correspond to your interests. Furthermore, data can also be stored in the usage profiles regardless of the devices you use. This is regularly the case if you are a member of the respective platforms and logged in to them.

For the statistics on our LinkedIn company page (Page Insights), we are joint controllers with LinkedIn Ireland Unlimited Company under Art. 26 GDPR. The agreement can be found at legal.linkedin.com/pages-joint-controller-addendum. LinkedIn assumes primary responsibility for this processing, including fulfilling your rights.

iv. Data Processing in case of Contact

We collect personal data when you contact us, for example, via a contact form or a messenger service. Which data is collected depends on the information you provide and the contact data you have provided or released. These are stored for the purpose of processing the request and for the case of follow-up questions with us. Under no circumstances will we pass on the data to third parties without your consent. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 (1) lit. f GDPR and, if applicable, Art. 6 (1) lit. b GDPR if your request is aimed at concluding a contract. Your data will be deleted after final processing of your request, if this does not conflict with any statutory retention obligations. We assume that processing is complete if it can be assumed from the circumstances that the matter in question has been conclusively clarified.

v. Data Processing for the Performance of Contracts

If your contact via a social network or other platform aims at the conclusion of a contract for the delivery of products or the provision of services with us, we process your data for the performance of the contract or for the implementation of pre-contractual measures or for the provision of the requested services. The legal basis for the processing of your data in this case is Art. 6 (1) lit. b GDPR. Your data will be deleted if it is no longer required for the performance of the contract or if it is determined that the pre-contractual measures do not lead to the conclusion of a contract corresponding to the purpose of the contact. Please note, however, that it may be necessary to store personal data of our contractual partners even after the conclusion of the contract to comply with contractual or legal obligations.

vi. Data processing based on consent

If you are asked by the respective providers of the platforms for consent to processing for a specific purpose, the legal basis of the processing is Art. 6 (1) lit. a., Art. 7 GDPR. Consent given can be withdrawn at any time with effect for the future.

vii. Data transfer and recipient

When you visit and use the platforms listed above, personal data may be transferred to the US or other third countries outside the EU, which is why further protection mechanisms are required in these cases to ensure the level of data protection of the GDPR. For more information on whether and which suitable guarantees the providers can provide for this, please see the list below.
We have no influence on the processing of your personal data by the provider and how it is handled. Likewise, we do not have any information on this. For more information, please check the privacy policy of the provider and, if necessary, use the opt-out/personalization options regarding data processing by the provider:

LinkedIn
- Privacy policy: https://www.linkedin.com/legal/privacy-policy
- Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
- LinkedIn, according to its privacy policy, uses standard data protection clauses to ensure an adequate level of data protection according to the requirements of the GDPR for data transfers to the US or other third countries outside the EU: https://www.linkedin.com/legal/privacy-policy and https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=de

4. Disclosure of data

Your personal data will not be transferred to third parties for purposes other than those listed below. We will only pass on your personal data to third parties
• if we have explicitly referred to this in the description of the respective data processing,
• if you have given your explicit consent to this in accordance with Art. 6 (1) S. 1 lit. a GDPR,
• if the disclosure is necessary for the assertion, exercise or defense of legal claims pursuant to Art. 6 (1) S. 1 lit. f GDPR and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
• if a legal obligation exists for the disclosure pursuant to Art. 6 (1) S. 1 lit. c GDPR, and
• as far as this is necessary for the processing of contractual relationships with you according to Art. 6 (1) S. 1 lit. b GDPR.
We also use external service providers for the processing of our services, which we have carefully selected, commissioned in writing and with whom we have concluded data processing agreements in accordance with Art. 28 GDPR. These are bound by our instructions and are regularly monitored by us. These are, among others, service providers for hosting, sending emails and maintenance and care of our IT systems, etc. The service providers will not disclose this data to third parties.

Recipients of data are in particular our hosting provider (section 1 e), Spott BV as provider of our candidate database (section 2 c), Anthropic Ireland, Limited as provider of the AI application Claude (section 2 i), Microsoft Ireland Operations Limited, Dublin, Ireland, as provider of our email and office communication (Microsoft 365), Google Ireland Limited for sending notifications from the contact form (section 2 h), our clients in the course of an appointment after your consent (section 2 c) and, only with your consent, Google Ireland Limited for web analytics and advertising (section 2 e).

5. Duration of the storage of personal data

The duration of the storage of personal data is measured by the relevant statutory retention periods (for example, from commercial law and tax law). After expiry of the respective period, the corresponding data is routinely deleted. If data is required for the fulfillment or initiation of a contract or if we have a legitimate interest in continuing to store it, the data will be deleted when it is no longer required for these purposes, or you have exercised your right of revocation or objection. The specific periods in section 2 c) apply to candidate data.

6. Data subject rights

You have the right:

to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
pursuant to Art. 16 GDPR, to request the correction of incorrect or incomplete personal data stored by us without undue delay;
pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims;
pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer need the data, but you need it for the assertion, exercise or defense of legal claims or you have objected to the processing pursuant to Art. 21 GDPR;
pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transferred to another controller;
in accordance with Art. 7 (3) GDPR, to withdraw your consent once given to us at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future;
complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

7. Right of objection

If your personal data is processed based on legitimate interests according to Art. 6 (1) S. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, if there are legitimate reasons which result out of your situation or if the objection is directed against direct marketing. In the last case, you have a general right of objection, which will be implemented by us without specifying a particular situation.
If you would like to make use of your right of withdrawal or objection, it is enough to send an e-mail to info@talentspy.de.

8. Data security

We take appropriate technical and organisational measures in accordance with Art. 32 GDPR to ensure a level of security appropriate to the risk. The connection to our website is encrypted throughout using TLS (HTTPS); your browser shows this with the padlock symbol in the address bar. We also protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties, and we continuously improve our security measures in line with technological developments.

9. Legal obligations

The provision of personal data for the decision on the conclusion of a contract, the performance of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make the decision in the context of contractual measures if you provide such personal data that is required for the conclusion of the contract, the fulfillment of the contract or pre-contractual measures.

10. Automated individual decision-making, including profiling

Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place. This also applies to the use of AI applications (section 2 i).

11. Updates and changes of this privacy policy

We reserve the right to update or change this privacy policy, if necessary, in compliance with the applicable data protection regulations. In this way, we can adapt it to the current legal requirements and consider changes to our services, for example, when introducing new services. The current version applies to your visit.

Date of this Privacy Policy: 27.10.2026