Recruiting Privacy Policy

Privacy information for candidates (Art. 13 and 14 GDPR)

This information applies to candidates whom we approach in the course of recruitment consulting and placement or who apply to us.

I. Controllers and data protection officer

The controller is the company through whose brand we contact you:

Numeris Consulting GmbH, Am Sandtorkai 48, 20457 Hamburg, Germany, e-mail: datenschutz@ctg-consulting.com

The companies of the CareerTeam Group use a shared recruiting platform and are joint controllers for processing in recruiting (Art. 26 GDPR, see section XI): CTG Consulting GmbH (with the brands Scalable Talent and Findus Finds), CareerTeam GmbH (with the brand Benomik), PALTRON GmbH, Numeris Consulting GmbH, Sinceritas GmbH, alphacoders GmbH and Foxio Consulting GmbH, each at Am Sandtorkai 48, 20457 Hamburg, Germany, and CareerTeam Schweiz GmbH, Weinplatz 10, 8001 Zurich, Switzerland.

Data protection officer for all companies named above:

ARTANA Digital GmbH, Prof. Dr. Christian Rauda, Alstertwiete 3, 20099 Hamburg, Germany, phone +49 40 537 981 260, e-mail: data.security.officer@numeris-consulting.de, www.artana.law

II. Purposes and legal bases

We process your data in order to match suitable candidates – individually or as a team – with companies that want to fill a position.

• Direct approach without a prior application: Art. 6(1)(f) GDPR. Our legitimate interest is to approach candidates individually, offer them suitable positions and fill our clients' vacancies.

• Application and ongoing placement process: Art. 6(1)(b) GDPR (pre-contractual steps and performance of the placement relationship).

• Inclusion in the group's candidate database beyond the specific process and special categories of personal data you provide voluntarily (e.g. information on a severe disability): your consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR. You can withdraw your consent at any time with effect for the future.

• Contact via WhatsApp: only with your express consent, Art. 6(1)(a) GDPR (see section VI).

III. Categories of personal data

Name; profile link (e.g. LinkedIn, XING); current and previous positions and employers; career history; skills, qualifications and languages; location; business contact details and – if you provide them – private contact details; search terms (skill tags) through which we found you; status and history of our contacts (e.g. contacted, response, interest, interview); notes from conversations; documents you send us (e.g. CV, references); the assessment of fit we produce (section V); your consents and objections.

IV. Sources of the data

Where we do not collect the data from you directly, it comes from the following sources:

• publicly accessible professional profiles on career networks, in particular LinkedIn and XING, and other publicly accessible professional platforms and websites (e.g. GitHub, Stack Overflow, personal websites);

• licensed profile data compiled from publicly accessible professional profiles by Coresignal (Coresignal UAB, Vilnius, Lithuania);

• for physicians (Sinceritas brand): commercially acquired directories of hospitals and clinics containing business contact details.

We inform you about this processing no later than at our first contact with you.

V. AI-assisted pre-selection

To find suitable candidates for a position, we compare profile data with the requirements of the position. For this we use AI language models (Google Vertex AI in the EU region europe-west4 and models operated in the EU via the Langdock platform). The system produces an assessment of fit (score and reasoning). This constitutes profiling within the meaning of Art. 4(4) GDPR.

No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place: whether you are contacted or presented to a client is always decided by a recruiter. The models are not trained with your data. The legal basis is Art. 6(1)(f) GDPR or, if you have applied, Art. 6(1)(b) GDPR. You may object to this processing at any time and request an explanation of the assessment.

VI. How we contact you

• LinkedIn and XING: messages via our recruiters' accounts. The mailboxes are connected technically via Unipile (Unipile SAS, France; data processed exclusively in France).

• Telephone: a brief, job-related first contact, Art. 6(1)(f) GDPR.

• E-mail: to business e-mail addresses of physicians (Sinceritas brand), Art. 6(1)(f) GDPR. Every e-mail contains a notice of your right to object and an unsubscribe option.

• WhatsApp: only after your express prior consent (Art. 6(1)(a) GDPR). The provider is Meta Platforms Ireland Ltd., Dublin, Ireland. Data may be transferred to the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time, e.g. by replying "STOP".

You can object to being contacted at any time – informally by e-mail to datenschutz@ctg-consulting.com, by replying to our message or via the unsubscribe link in our messages and in the candidate portal.

VII. Candidate portal

When we contact you, you receive a personal link to our candidate portal. There you can view information on the position, upload documents, book appointments and send us messages. We log your consents and objections as evidence (Art. 7(1) GDPR). The legal basis is Art. 6(1)(b) GDPR and, for voluntary information, your consent (Art. 6(1)(a) GDPR).

VIII. Recipients

• Internal: only the staff of the responsible company who handle the respective position. Within the shared platform, data is separated by brand.

• Clients: potential employers only receive your data after you have agreed to it being passed on.

• Service providers (processors under Art. 28 GDPR):

– Google Cloud EMEA Ltd., Dublin, Ireland – operation of our applicant management system (region Frankfurt), AI service Vertex AI (region europe-west4), Google Workspace (e-mail, calendar, documents, video conferencing with Google Meet);

– Supabase, Inc., USA – database of the recruiting platform, hosted in Frankfurt am Main;

– Vercel Inc., USA – hosting of the recruiting application and the candidate portal, region Frankfurt am Main;

– Hetzner Online GmbH, Gunzenhausen, Germany – servers for our workflow automation, located in Germany;

– Langdock GmbH, Berlin, Germany – access to AI language models, processing in the EU;

– Unipile SAS, France – connection of our recruiters' LinkedIn and e-mail mailboxes;

– Pipedrive OÜ, Tallinn, Estonia – customer relationship management;

– Sinceritas brand only: eRecruiter GmbH – applicant management system.

IX. Transfers to third countries

Transfers outside the EU/EEA only take place where there is an adequacy decision of the European Commission (e.g. for Switzerland or for US companies certified under the EU-U.S. Data Privacy Framework) or where appropriate safeguards exist, in particular EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). This concerns WhatsApp (Meta) and support access by the US parent companies of our hosting providers; our platform data itself is stored in the EU. If we present you to a client outside the EU, we will inform you of the recipient and the country beforehand.

X. Retention period

We delete your data once the collaboration in the recruiting process ended more than six months ago, no consent to further storage exists and there is no legitimate interest in storage. Such a legitimate interest exists

• for data you have published on career networks (e.g. name, profile link, position, employer), the search terms through which we found you and the status of our contacts, for as long as your profile is publicly accessible;

• for data we need to prove a placement to our clients, until the three-year limitation period expires.

If you have consented to the processing of special categories of personal data and withdraw this consent, we delete this data without undue delay unless a legal obligation prevents this.

XI. Joint controllership (Art. 26 GDPR) – essence of the arrangement

• The companies named in section I jointly determine the purposes and means of processing in recruiting and client acquisition and use a shared recruiting platform.

• Each company provides the information required under Art. 13 and 14 GDPR and ensures the lawfulness of its processing.

• You can exercise your rights against any of the companies involved; the companies forward your request to one another.

• Personal data breaches are notified by the company in whose sphere the breach occurred, or by CTG Consulting GmbH if this is unclear.

XII. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3)). You can lodge a complaint with a data protection supervisory authority, in particular the Hamburg Commissioner for Data Protection and Freedom of Information.

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR – in particular for direct approaches and AI-assisted pre-selection – you may object to this processing at any time. We will then no longer process your data for these purposes.

Further details can be found in the privacy policy of the respective company: CTG Consulting GmbH – www.ctg-consulting.com/datenschutz; CareerTeam GmbH – www.careerteam.de/datenschutz; CareerTeam Schweiz GmbH – www.careerteam.ch/datenschutz; PALTRON GmbH – www.paltron.com/privacy-policy; Numeris Consulting GmbH – www.numeris-consulting.de/datenschutz; Sinceritas GmbH – www.sinceritas.com/datenschutz; alphacoders GmbH – www.alphacoders.de/datenschutz; Foxio Consulting GmbH – www.foxio.com/datenschutz.

As of September 2026