Privacy Policy

Information on the collection of personal data

(1) In the following, we inform you about the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail address, user behaviour.

(2) The controller pursuant to Art. 4 (7) GDPR is:

HEADSAHEAD GmbH

Goltsteinstraße 14
40211 Düsseldorf

AG Düsseldorf HRB 76900
info@headsahead.com

Tel: +49 211 – 54 21 06 – 0
Fax: +49 211 – 54 21 06 – 99

(3) You can reach us at info@headsahead.com (see also our legal notice). You can reach our Data Protection Officer at datenschutz@headsahead.com or at our respective postal address with the addition “the Data Protection Officer“.

(4) When you contact us by e-mail, telephone, post or via a contact form, the data you provide (where applicable your e-mail address, your name and/or your telephone number) is stored by us in order to answer your questions (the legal basis is Art. 6 (1) sentence 1 lit. f GDPR). We delete the data arising in this context once its storage is no longer necessary, or we restrict the processing if statutory retention obligations apply.

Your Rights

(1) You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • right of access,
  • right to rectification or erasure,
  • right to restriction of processing,
  • right to object to the processing,
  • right to withdraw a consent that has been given,
  • right to data portability.

(2) You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us.

Collection of personal data when visiting our website

In the case of merely informational use of the website, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. When you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis is Art. 6 (1) sentence 1 lit. f GDPR):

  • IP address
  • date and time of the request
  • time zone difference to Greenwich Mean Time (GMT)
  • content of the request (specific page)
  • access status/HTTP status code
  • the amount of data transferred in each case
  • website from which the request comes
  • browser
  • operating system and its interface
  • language and version of the browser software.

Use of Borlabs Cookie and WPML Cookie. The website uses Borlabs Cookie. This tool stores the users’ cookie preferences and ensures that non-essential cookies are only set after the user’s consent. The storage takes place on the basis of Art. 6 (1) lit. c GDPR (legal obligation to obtain consent) as well as Art. 6 (1) lit. f GDPR (legitimate interest in a legally secure documentation of consents).

Cookies used:

1: wp-wpml_current_language

Purpose: Stores the user’s current language in order to display the correct language version of the website.

Provider: WPML (OnTheGoSystems Limited)

Storage period: 1 day

2: Borlabs Cookie

Purpose: Stores the user’s consents for various cookie categories.

Provider: Borlabs GmbH

Storage period: 1 year

You can adjust your cookie settings at any time under “Revise cookies“ via the following link: https://www.headsahead.com/.

OBJECTION OR WITHDRAWAL AGAINST THE PROCESSING OF YOUR DATA

(1) If you have given consent to the processing of your data, you can withdraw it at any time. Such a withdrawal affects the permissibility of the processing of your personal data after you have declared it to us.

(2) Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. When exercising such an objection, we ask you to set out the reasons why we should not process your personal data as we have done. In the case of your justified objection, we will examine the situation and will either discontinue or adjust the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing.

INTEGRATION OF THIRD-PARTY SERVICES AND CONTENT ON OUR WEBSITE

The legal basis for the use of these services and the associated processing of personal data arises from Art. 6 (1) lit. f GDPR. We have a legitimate interest in the operation, optimisation and appealing presentation of our website.

Use of links to social media websites

(1) Our website currently contains links to the following social media websites:

Xing and LinkedIn

When you visit our site, no personal data is initially passed on to the providers of the social media websites as a matter of principle. You can recognise the provider of the social media website by its initial letter or logo. We give you the possibility to reach the respective social media website directly via this link.

(2) Should you visit one of the linked social media websites, we have no influence on the data collected and the data processing operations, nor are we aware of the full extent of the data collection, the purposes of the processing or the storage periods. We also have no information about the deletion of the collected data by the provider of the social media website.

(3) If you visit one of the linked social media websites and are logged in with the provider of the social media website, your data is directly assigned to your existing account with the provider of the social media website. We recommend that you log out regularly after using a social network, but in particular before using the link, as you can thus avoid an assignment to your profile with the provider of the social media website.

(4) Further information on the purpose and scope of the data collection and its processing by the provider of the social media website can be found in the privacy policies of these providers communicated below. There you will also receive further information on your respective rights and setting options for the protection of your privacy.

Addresses of the respective providers and URL with their data protection notices:

USE OF GOOGLE WEB FONTS

(1) On our website, for the purpose of a uniform presentation of fonts on your device, we use external fonts (“Google Fonts“) provided by Google. Google Fonts is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you call up our website, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly. The integration of the web fonts takes place via an interface (“API“) to the Google services. Through the integration of the web fonts, Google may collect information (including personal data) and process it in the USA. Google LLC has submitted to the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/), which ensures an adequate level of data protection for the transfer of personal data to the USA. We ourselves do not collect any data in the context of providing the Google Fonts.

(2) The provision of personal data is not required or mandatory. Failure to provide it may result in you not being able to use our website or not being able to use it in full, and in the presentation of the website changing.

(3) You can set your browser so that the fonts are not loaded from the Google servers. If your browser does not support Google Fonts or you prevent access to the Google servers, the text will be displayed in the system’s default font.

(4) You can find more detailed information at:

Integration of Google Maps

(1) On this website we use the service of Google Maps. This enables us to display interactive maps directly on the website and allows you to conveniently use the map function.

(2) By visiting the website, Google receives the information that you have called up the corresponding subpage of our website. In addition, the data mentioned under the section “Collection of personal data when visiting our website“ is transmitted. This takes place regardless of whether Google provides a user account through which you are logged in, or whether no user account exists. If you are logged in with Google, your data is directly assigned to your account. If you do not wish the assignment with your profile at Google, you must log out. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the demand-oriented design of its website. Such an evaluation takes place in particular (even for users who are not logged in) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must contact Google to exercise it.

(3) Further information on the purpose and scope of the data collection and its processing by the plug-in provider can be found in the provider’s privacy policies. There you will also receive further information on your respective rights and setting options for the protection of your privacy: http://www.google.de/intl/de/policies/privacy. Google LLC also processes your personal data in the USA and has submitted to the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/).

PROCESSOR MICROSOFT 365 AND COPILOT

(1) For our internal communication, document management and AI-assisted productivity, we use Microsoft 365 as well as the associated AI tool Microsoft 365 Copilot, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (hereinafter “Microsoft“). In this context, Microsoft processes personal data as a processor pursuant to Art. 28 GDPR.

(2) A data processing agreement (Data Processing Addendum, DPA) exists with Microsoft. Microsoft processes personal data generally within the European Union and the European Economic Area (EU Data Boundary). Insofar as processing exceptionally takes place in a third country (in particular the USA), it is safeguarded by the EU-US Data Protection Framework (Data Privacy Framework) or standard contractual clauses. Prompts and responses in Microsoft 365 Copilot are not used for the training of AI models. Further information on data protection at Microsoft can be found at: https://www.microsoft.com/de-de/trust-center/privacy.

(3) In the context of using Microsoft 365 Copilot, personal data, in particular candidate and customer data, may be processed by the AI system, provided that this data is stored in the company’s Microsoft 365 environment. This processing takes place on the basis of Art. 6 (1) lit. f GDPR (legitimate interest in the efficient and secure design of our business processes).

AI-ASSISTED PROCESSING

(1) In the course of our business activities, we use AI-assisted tools, in particular Microsoft 365 Copilot. These tools support us in research, document creation, internal communication and data management. In accordance with the requirements of the EU AI Act (Art. 50), we inform you about the use of these systems.

(2) We expressly point out that all decisions concerning candidates or customer companies, in particular the selection and assessment of persons within the scope of search mandates, are made exclusively by our employees. AI systems are used exclusively as an auxiliary tool and do not make any independent decisions about persons. An automated individual decision within the meaning of Art. 22 GDPR does not take place. AI-generated results are always reviewed by a human before their use.

(3) AI systems are not used by us to automatically assess, rank or select candidates. The use is limited to administrative and productivity-enhancing tasks without influence on personnel decisions. In the use described by us, Copilot is not used for the high-risk purposes referred to in Art. 6 in conjunction with Annex III No. 4 EU AI Act. An automated assessment, ranking or profiling of persons does not take place.

PROCESSING OF CANDIDATE AND CUSTOMER DATA

(1) This privacy policy applies not only to persons who visit our website or actively contact us, but also to persons whose personal data we process in the course of our activity as an executive search and headhunting service provider, without this data having been collected directly from the data subjects by us (Art. 14 GDPR). This concerns in particular candidates as well as contact persons at customer companies.

(2) The personal data processed by us originates from the following sources:

  • Publicly accessible professional profiles and networks (e.g. LinkedIn, XING);
  • Recommendations by third parties (e.g. business partners, other candidates);
  • Information communicated in the course of application processes or direct conversations (e.g. CVs, interview notes);
  • Publicly accessible company websites and specialist databases.

(3) For this purpose, we process in particular the following categories of personal data: contact data (name, address, e-mail address, telephone number), professional qualifications and career, areas of activity and industry experience, information on salary expectations and availability as well as conversation notes and correspondence within the scope of the placement process.

(4) The processing takes place for the purpose of placing executives and specialists as well as for the fulfilment of our contractual obligations towards customer companies. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in carrying out personnel placement). The legitimate interest prevails, since candidates in the professional context typically expect a professional approach by executive search service providers. For customer data, Art. 6 (1) lit. b GDPR (performance of a contract) applies as the primary legal basis.

(5) Insofar as your data was not collected directly from you, you will receive this information at the latest upon the first contact by us, as a rule by e-mail or telephone. Upon the first contact, we draw your attention to this privacy policy.

(6) Personal data of candidates and customer contacts is deleted as soon as it is no longer necessary for the respective placement purpose and no statutory retention obligations conflict with this. We review the continued necessity at regular intervals. Upon request, your data is deleted without undue delay, provided that the conditions of Art. 17 GDPR are met and provided that no statutory retention obligation exists. (7) You are entitled to all the data protection rights described under “Your Rights“, in particular the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to the processing (Art. 21 GDPR). To assert your rights, please contact the contact address mentioned above or directly our Data Protection Officer.

DATA DELETION AND STORAGE PERIOD

Your personal data is deleted or blocked as soon as it is no longer required for its intended purpose and no statutory retention obligations conflict with the deletion. Insofar as the data is not deleted because it is required for other and legally permissible purposes, its processing is restricted.