Privacy Policy

ZOOM Consult GmbH | Last updated: 11 November 2026

At ZOOM Consult GmbH (hereinafter referred to as ‘we’ or ‘us’), we attach great importance to the protection of your personal data. This Privacy Policy provides you with information, in accordance with the General Data Protection Regulation (GDPR), on how we collect, process and protect personal data on our website www.zoom-consult.de and in connection with our services in the areas of executive search, recruitment, career coaching and NewPlacement.

For the purposes of this Privacy Policy, we distinguish between the following roles:

• Private clients are natural persons who commission or use our consultancy, coaching or other services for their own professional situation. They are the clients under the respective consultancy or coaching contract and do not automatically become candidates as a result of this contract. Executives whose coaching or NewPlacement is funded by an employer are also considered private clients for the purposes of this policy.
• Candidates are natural persons whose professional data we process as part of a search or placement commissioned by a company, with a view to introducing them, where appropriate, to a specifically named corporate client. Candidates also include individuals who send us their CV via our website or apply for a published vacancy. Candidates are not the clients for the search or placement services we provide and therefore owe us no fee in this regard.
• Corporate clients are companies or other organisations that commission us to provide executive search, recruitment or consultancy services. This also includes employers who fund coaching or new placement services for executives.
• Contact persons for corporate clients are individuals who communicate with us on behalf of a corporate client or are involved in the execution of an assignment.
• Target decision-makers are individuals within companies and other organisations whom we research as part of a consultancy service for a private client and, where appropriate, approach in their professional capacity. They are neither candidates nor contact persons for corporate clients.

A person may have several roles, depending on the specific use of our services. Data processing in the respective context is governed exclusively by the specific role and the specific service utilised. The terms ‘private client’, ‘candidate’, ‘corporate client’ and ‘addressed decision-maker’ are not used interchangeably in this privacy policy.

Precisely because we offer executive search and career coaching from a single source, we adhere to a clear principle: a coaching engagement does not automatically lead to inclusion in our candidate database, nor does it result in documents being passed on to potential employers.

Which sections apply to you?

• If you commission or use our consultancy, coaching or NewPlacement services for your own professional situation, you are a private client. In particular, Section 12, the general sections and the relevant sections relating to the specific service apply to you.
• If you are approached or considered as a professional candidate as part of a search or recruitment process commissioned by a company, or if you submit your CV to us via our website, you are a candidate. Sections 9 and 13 apply to you in particular.
• If you communicate with us on behalf of a company, or if a company commissions us to search for, select or present candidates, or to carry out a NewPlacement, you are a corporate client or a contact person for a corporate client. Section 14 applies to you in particular.
• If we contact you in your professional capacity on behalf of a private client, or if we have carried out research on you for that purpose, you are the decision-maker to whom we are addressing. Section 12.4 and the general sections apply to you.
• The general sections, in particular those relating to the data controller, service providers, transfers to third countries, retention periods, data subjects’ rights and amendments, apply to all data subjects.

1. Data controller

The data controller within the meaning of the GDPR is:

ZOOM Consult GmbH, represented by its Managing Director Nicole Kremer, Rheinstr. 31, 80803 Munich, Germany. Email: nicole.kremer@zoom-consult.de. Telephone: +49 172 869 09 19. Website: www.zoom-consult.de

Based on our current assessment, there is no obligation to appoint a data protection officer pursuant to Article 37(1) of the GDPR. We have designated a dedicated point of contact for all enquiries regarding data protection and the exercise of your rights: Data Protection Co-ordinator: Nicole Kremer, email: nicole.kremer@zoom-consult.de.

2. Overview of processing activities and legal bases

We process personal data only to the extent necessary to provide a fully functional website, our content and our services. Processing is carried out in particular on the following legal bases:

• Consent (Article 6(1)(a) of the GDPR), for example for inclusion in our candidate pool for future assignments or when using consent-based AI-supported tools in interviews.
• Performance of a contract or pre-contractual measures (Article 6(1)(b) of the GDPR), for example when providing or preparing our consultancy and coaching services, or when processing a CV submitted via our website.
• Legitimate interests (Article 6(1)(f) of the GDPR), for example for the operation and security of the website, the search for and direct approach of candidates as part of a search mandate, communication with contacts at corporate clients, and the search for and approach of decision-makers on behalf of private clients.
• Legal obligation (Art. 6(1)(c) GDPR), for example, to comply with tax or commercial law retention requirements.

3. Data security

This website uses TLS encryption for security reasons and to protect the transmission of confidential content, such as enquiries or documents that you send to us as the website operator. You can recognise an encrypted connection by the fact that the address bar of your browser changes from ‘http://’ to ‘https://’, and by the padlock icon in your browser bar. When TLS encryption is enabled, the data you transmit to us cannot be read by third parties. This applies in particular to the transmission of your CV via our CV upload form.

We implement appropriate technical and organisational measures in accordance with Article 32 of the GDPR. These include, in particular, data minimisation, restrictions on access to personal data, appropriate access controls and defined retention periods.

Executive search is a matter of trust. Many of our candidates are currently in permanent employment. Access to candidate data is therefore strictly restricted. Only authorised persons have full access.

4. Hosting

We host the content of our website with the following provider: ALL-INKL.COM – Neue Medien Münnich, owned by René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (hereinafter ‘All-Inkl’), server location: Germany. For further details, please refer to All-Inkl’s privacy policy: https://all-inkl.com/datenschutzinformationen/. The use of All-Inkl is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible.

We have entered into a data processing agreement (DPA) with All-Inkl in accordance with Article 28 of the GDPR. This ensures that All-Inkl processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

5. Server log files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Amount of data transferred
• Access status (HTTP status code)
• Browser type and version, and operating system
• Referrer URL (previously visited page)

This data is not combined with other data sources. The collection of this data is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring the technically error-free display and optimisation of our website – to this end, the server log files must be recorded.

The log file data is deleted after 30 days at the latest, unless further retention is required for evidential purposes or due to legal obligations.

6. Cookies and audience measurement

Our website does not use cookies for analytical, marketing or advertising purposes, nor does it incorporate any services that store or read information on your device and would require your consent to do so. A cookie banner is therefore not required. Should we use any services in future that require consent, we will obtain your consent in advance and amend this privacy policy accordingly.

6.1 Audience measurement (Koko Analytics)

We use the WordPress plugin Koko Analytics to measure website traffic. It runs exclusively on our own web server; no data is transmitted to the provider or to third parties. Koko Analytics records which pages are accessed, the number of visits and the websites from which visitors come to our site.

We use Koko Analytics in cookie-free mode: no cookies are set, and no information is stored on or retrieved from your device. To recognise repeat page views on the same day, the plugin generates an encrypted hash from your IP address and your browser’s identifier; this is regenerated daily and completely deleted at midnight. Your IP address itself is not stored. It is not possible to identify you personally or to cross-reference data across multiple days; no user profile is created. Only aggregated figures are stored.

The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the data protection-friendly analysis of the use of our website.

6.2 Fonts

This site uses so-called Google Fonts, provided by Google, to ensure a consistent display of fonts. The Google Fonts are installed locally. No connection is made to Google’s servers. Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

This site also uses Font Awesome to display icons. Font Awesome is installed locally. No connection is made to servers operated by Fonticons, Inc. Further information on Font Awesome can be found in the Font Awesome privacy policy at: https://fontawesome.com/privacy.

7. Social media links and external links

Our website features a simple link to our company page on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). This is not an embedded plugin. No data is transmitted to LinkedIn when you visit our website. Only when you click on the link is a connection established between your browser and LinkedIn’s servers. LinkedIn thereby receives the information that you have come from our website via your IP address. If you are logged in there, the visit can be attributed to your user account. Further information can be found in LinkedIn’s privacy policy on the provider’s website.

Our website also contains links to the websites of our network partners, such as M4Trinity, AI Executive Career Lounge, Einwerk Consulting and wefindtalents. The respective operator is responsible for data processing on these websites; their privacy policies apply. We do not transmit any data to these partners simply by visiting our website.

8. Contact by email or telephone

If you contact us by email or telephone, your enquiry, including any personal data it contains (name, enquiry), will be stored and processed by us for the purpose of dealing with your request. We will not pass on this data without your consent. The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that such consent has been sought; consent may be withdrawn at any time. The data you send to us via contact enquiries will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

9. CV upload and applications for assignments

On our website, you can send us your CV via the ‘Upload CV’ form, either as a speculative application or in response to a search mandate published on our ‘Mandates’ page. The information you provide in the form will be processed: your name and email address (mandatory fields), optionally the position or reference number of the vacancy and a brief description of your enquiry, as well as your CV (PDF or Word, mandatory field) and the information it contains.

The form data is transmitted to us in encrypted form (TLS) and stored in our website’s database on the All-Inkl server in Germany. We are notified of receipt via an email sent to bewerbung@zoom-consult.de. Your CV is not sent by email, but remains on our server and is accessible only to authorised persons. You will receive an automatic confirmation of receipt at the email address you have provided. The form data and your CV will be automatically deleted from our web server after a maximum of one month.

We will review your documents in confidence to assess whether you are suitable for a specific ongoing assignment and to contact you. The legal basis is Article 6(1)(b) of the GDPR (pre-contractual measures in response to your enquiry). Submitting the form does not automatically result in you being introduced to a corporate client: an introduction will only take place following your prior consent for the specifically named company (section 13.3).

If you send us your CV without there being a suitable assignment available, and you would like us to retain your profile for future assignments, we will seek your separate consent for this (Section 13.4).

Please do not include any health data or other special categories of personal data (Section 15) in your CV, nor a photograph unless it is required.

10. Booking appointments via Calendly

We use the appointment booking service Calendly, provided by Calendly, LLC, 115 E. Main Street, Suite A1B, Buford, GA 30518, USA, to arrange initial and orientation meetings. Bookings are made on the Calendly website; our website merely provides a link to it. The data you provide when booking is processed: your name, email address, the selected appointment time and any voluntary details regarding your enquiry. When you access Calendly, technical connection and usage data is also processed by the provider. We transfer the appointments to our calendar.

Booking a consultation as a manager in connection with our own consultancy or coaching services constitutes a pre-contractual enquiry from a private client. It does not automatically constitute a job application or inclusion in the candidate database.

The legal basis is Article 6(1)(b) of the GDPR (pre-contractual measures in response to your enquiry); for appointment arrangements with company contacts, it is Article 6(1)(f) of the GDPR (legitimate interest in efficient appointment organisation). Where required by law, the integration is carried out on the basis of a data processing agreement in accordance with Article 28 of the GDPR. As the company is based in the USA, there is a third-country transfer; further details are set out in Section 18. Alternatively, you can arrange an appointment by email or telephone. Further information can be found in Calendly’s privacy policy on the provider’s website.

11. Business email, calendars and document storage

For our business communications and internal organisation, we use Microsoft 365 provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. This includes, in particular, business emails, calendars and document storage. The data processed includes, in particular, the name and email address of the sender and recipient, the content of the message or document, the date and time, and any attached files. Documents relating to candidates, private clients and corporate clients – such as CVs, meeting notes, consultancy documents and client-related correspondence – may also be stored there.

Depending on the nature of the processing, the legal basis is either Article 6(1)(b) of the GDPR or Article 6(1)(f) of the GDPR. Where necessary, a data processing agreement is in place in accordance with Article 28 of the GDPR. The retention periods are the same as those applicable to the underlying data (Section 19). We review the data held annually.

12. Data processing for private clients of consultancy, coaching and NewPlacement services

We process contact details, contractual and billing data, as well as the information required to prepare for and carry out the specific service commissioned. This may include CVs, references, career objectives, the results of strengths and potential analyses, and the content of consultancy sessions. The legal basis is Article 6(1)(b) of the GDPR for the performance of a contract and pre-contractual measures, and, where applicable, Article 6(1)(f) of the GDPR for legitimate interests. Article 6(1)(c) of the GDPR applies to statutory retention obligations.

Private clients do not automatically become candidates as a result of this service. Your data will not be included in the candidate database solely on the basis of a consultancy or coaching contract; you will not be subject to a suitability assessment for a position; and your data will not be transferred to corporate clients or potential employers for recruitment purposes. This also applies if we are simultaneously managing ongoing search mandates. If you would also like to be considered as a candidate for a specific assignment, this constitutes a separate service, about which we will inform you separately and for which we will seek your consent.

12.1 NewPlacement and employer-funded coaching

If an employer funds your coaching or NewPlacement, the employer is our corporate client; you yourself remain a private client within the meaning of this statement. Before the programme begins, we agree with the employer on what organisational information they will receive, such as the start date, duration and completion of the programme. We do not pass on the content of personal discussions, analysis results or individual consultancy documents to the employer unless you have given your express consent.

The legal basis is Article 6(1)(b) of the GDPR in relation to you, and Article 6(1)(f) of the GDPR for coordination with the funding employer.

12.2 Approaching companies and headhunters on behalf of private clients

As part of our consultancy services, we contact companies, decision-makers and headhunters on behalf of private clients at their request. The private client must individually approve which companies or individuals are to be contacted prior to any such contact. No contact will be made without this approval.

Upon request, we may initially approach a company without disclosing your name. In doing so, we provide details of your career history, areas of expertise, a pseudonymised brief profile and the text of the approach as agreed with you. If you have expressly consented to your details being passed on to a specific company, we will also provide your name and, at the company’s request, your CV. We do not disclose health data or other special categories of personal data.

A pseudonymised short profile contains no name, no current employer and no uniquely identifying details. Nevertheless, it remains personal data in pseudonymised form. Particularly in niche markets such as beauty, lifestyle and retail, it cannot be ruled out – despite careful pseudonymisation – that individual recipients may draw conclusions about you from the experience described. We will discuss this risk before making contact. You decide when your identity is disclosed.

If the company being approached is located outside the European Union or the European Economic Area, the data released will be transferred to the country in question. There may be no adequacy decision by the European Commission for that country, nor a level of protection comparable to that under European law; rights under the GDPR may be more difficult to enforce there. Before the data is disclosed, we will specify the destination country and draw your attention to this risk; we will document your authorisation. In individual cases, the transfer may be based on your explicit consent to the respective contact in accordance with Article 49(1)(a) of the GDPR. Where another suitable safeguard is relevant and available for the destination country or the recipient – in particular an adequacy decision by the European Commission or standard contractual clauses pursuant to Article 46(2)(c) of the GDPR – we base the transfer on that safeguard. For the retention period, see Section 19.

12.3 Recording, transcription and AI-assisted analysis of conversations

We only record coaching sessions, training sessions, candidate interviews and company briefings with the separate, prior and voluntary consent of all participants, and we only analyse them on this basis. The legal basis is Article 6(1)(a) of the GDPR. For transcription, documentation and AI-assisted summarisation, we use the Hedy application from Hedy AI LLC, 5331 S Macadam Ave, Ste 258 PMB 1137, Portland, OR 97239-3871, USA. Before the session begins, we will explain whether audio will be recorded, a transcript produced and/or an AI summary generated. For information on Hedy’s involvement with third countries, see Section 18.

You may withdraw your consent at any time with future effect. Refusal or withdrawal of consent will not affect the agreed scope of the personal consultation or your inclusion in a mandate. We delete transcripts once the summary has been produced; Section 19 applies to the summary.

12.4 If we conduct research on your behalf or contact you on behalf of a private client (contacted decision-makers)

This section applies to individuals whom we research in their professional capacity as potential contacts for a private client and, where appropriate, contact (Section 12.2). We have not collected your data directly from you. This section provides you with information in accordance with Article 14 of the GDPR.

Purpose. We advise executives on their career reorientation. To this end, we identify companies for which our client’s experience may be of interest, and the relevant decision-makers within those organisations. We process your data to assess whether you are a suitable contact, to approach you on behalf of our client or to provide your name to our client so that they may contact you directly, and to document the contact and your response. We research and store details of decision-makers only in the context of a specific assignment.

Data processed. Name, professional role, company, area of responsibility, publicly available professional background, professional contact details such as business email address, telephone number and the address of your profile on professional networks, publicly known events at your company such as a change in management or funding, the source of the respective information, as well as our messages to you, your replies and their outcome. We do not process special categories of personal data as defined in Article 9(1) of the GDPR.

Sources. Publicly available sources, in particular company websites, professional networks such as LinkedIn, commercial and company registers, press and industry reports, as well as event and conference websites; in addition, information provided by our client and our own professional network. We also use AI-supported tools for our research. In our first message to you, we will specify the source of your contact details.

Legal basis. Article 6(1)(f) of the GDPR. Our legitimate interest, and that of our client, lies in specifically approaching decision-makers in their professional capacity to identify a suitable executive. We safeguard your interests by processing only professional information from publicly available sources, contacting you only for a specific professional purpose, limiting the storage period, and acting immediately on any objection.

Recipients. Our client will be provided with your name, your role, your company and, following contact, your response. If the client contacts you directly, we will also provide them with the appropriate contact details. In addition, the service providers listed in Section 17 process your data on our behalf. If we contact you via a professional network such as LinkedIn, the operator of that platform will process the message in accordance with its own privacy policy.

When we inform you. If we contact you, our first message will already contain a brief note stating the source and a link to this section. If our client contacts you directly, they may also refer to this section in their first message. If we do not contact you ourselves, we will not notify you separately, as this would involve a disproportionate effort (Article 14(5)(b) of the GDPR). In this case, we will inform you via this section, store only the professional details mentioned, and delete them in accordance with the time limits set out below.

Retention period. We will delete your data six months after the end of the assignment for which we researched you, unless you have consented to the storage of your data. If you object, we will delete it immediately. We will only retain your name, company and the date of your objection on a block list to ensure that we do not contact you again on behalf of other clients.

Your rights. You may object to the processing of your data at any time (Article 21 of the GDPR). To do so, simply reply briefly to our message or send an informal email to nicole.kremer@zoom-consult.de. Your other rights, such as the right to access, rectification and erasure, are set out in Section 21; your right to lodge a complaint is set out in Section 24.

No automated decision-making. Tools suggest potential contacts; we decide whether to contact you in consultation with our client. No automated decision-making within the meaning of Article 22 of the GDPR takes place.

You are under no obligation to provide us with data or to reply to our message.

13. Data processing when you are a candidate in a recruitment or placement process commissioned by a company

This section applies exclusively to candidates as defined above, i.e. to individuals whom we research, approach or support as part of an executive search or recruitment process, as well as to individuals who submit their CV to us via our website.

13.1 Categories of personal data

The personal data we process about you as a candidate includes, in particular:

• Name, professional and personal contact details
• Professional background, qualifications, areas of expertise and management experience
• Details of previous and current employers
• Reasons for changing jobs, availability, notice periods and salary expectations
• Application documents, client-specific interview notes and our professional assessments
• Results of digital HR assessments, where you have taken part (section 13.7)
• Work permit, where relevant to a specific position
• Contact details of referees, only with your consent
• Details of hobbies and interests, where you provide them to us of your own accord; we do not ask for them

13.2 Sources of data

We obtain this data from the following sources:

• From you, for example via your CV submitted through our CV upload form, by email or in a face-to-face meeting
• Publicly accessible professional networks, in particular LinkedIn
• Company websites, press releases and industry news
• Our own professional network and recommendations from within the industry
• References, only after consultation with you
• Our network partners in executive search, provided they are legally permitted to pass the data on to us

If we have not collected your data directly from you, we will inform you of the source no later than one month after collection; however, upon first contact, we will inform you of this at that time (Article 14(3) of the GDPR).

13.3 Use of your personal data

We process candidate data as part of a search commissioned by a corporate client in order to assess your suitability for the specific role described and, where applicable and with your consent, to introduce you to the relevant corporate client. For this purpose, your personal data will only be transferred to the extent necessary for the specific introduction and provided that your prior consent has been obtained for the specifically named company. The corporate client processes the data in its selection process under its own responsibility. We do not obtain references without your prior consent; we never contact your current employer in this context without your express consent.

If you have submitted your documents to us yourself, for example via our CV upload form, Article 6(1)(b) of the GDPR forms the legal basis, insofar as the processing serves the purpose of taking pre-contractual measures in response to your enquiry. If we have approached you as a result of our own research, we rely on Article 6(1)(f) of the GDPR; our legitimate interest and that of the recruiting company lie in identifying suitable executives for a specific position. You may object to this processing under Article 21 of the GDPR. To introduce you to a specific corporate client, we will also seek your consent under Article 6(1)(a) of the GDPR.

13.4 Consent, withdrawal of consent and candidate pool

If, as a candidate, you submit data and content to ZOOM Consult GmbH, you confirm that we are entitled to use this data for the stated purposes and that no third-party rights preclude such use.

Beyond a specific assignment, we will only store your profile for future suitable assignments with your separate, voluntary consent (Article 6(1)(a) of the GDPR). If you refuse to give your consent, this will not affect your consideration for the current assignment.

You may withdraw your consent at any time with future effect, opt out of our candidate support services and request the erasure of your data. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected. We will delete your data as soon as we no longer have a legitimate interest in its use or you have informed us that you do not wish to use our services. To a limited extent, your name, company and date may be retained on a block list to prevent unwanted repeated contact.

13.5 Candidate database

We currently store our candidates’ data in the Ezekia ATS system operated by Ezekia Ltd, United Kingdom. We are gradually migrating to the PARL ATS system operated by Meyer Talent Acquisition GmbH, Grunowstraße 20a, 13187 Berlin, Germany (server location: Germany).

In particular, we process the categories of data specified in section 13.1, your application documents, your career history and the history of our collaboration. To update or delete your profile, please contact us by email at nicole.kremer@zoom-consult.de.

Where required by law, the integration is carried out on the basis of a data processing agreement in accordance with Article 28 of the GDPR.

13.6 AI-supported candidate identification and data processing

In executive search, we use AI-powered tools to identify potential candidates for a specific assignment from publicly available professional sources, to match profiles against the agreed requirements, to summarise interview notes and texts, and to organise our workflow. AI tools used: LinkedHelper, Hedy and Claude (Anthropic).

The AI tools support our research. The assessment of experience, motivation and fit, as well as all decisions regarding outreach, shortlisting and presentation to a corporate client, are made exclusively by our human consultants. There is no automated assessment, scoring or ranking of candidates by AI. The legal basis is Article 6(1)(f) of the GDPR or Article 6(1)(b) of the GDPR if you have submitted your documents to us yourself.

The recording, transcription and AI-assisted evaluation of candidate interviews take place only with your separate, prior and voluntary consent (Section 12.3).

13.7 Digital personnel diagnostics

In suitable cases, we offer candidates – and, as part of coaching, private clients – a digital personality and potential analysis. For this purpose, we use LINC PROFILER, LINC GmbH, Grapengießerstr. 16, 21335 Lüneburg, Germany, email: info@linc.de, www.linc.de.

Your answers in the questionnaire and the resulting profile are processed.

Participation is voluntary and takes place only with your consent (Art. 6(1)(a) GDPR). We will discuss the results with you before they are used. We will only pass on results to a corporate client if you have expressly consented to this for that specific company.

14. Data processing for corporate clients and their contacts

This section applies exclusively to corporate clients and their contact persons. Corporate clients are those who commission the search for, selection or introduction of candidates, as well as employers who fund a NewPlacement or coaching programme. It does not apply to candidates or to private clients.

In order to be able to provide or prepare the commissioned service for a corporate client, we process personal data relating to the corporate client’s contact persons and, where applicable, other individuals employed by the company, in particular contact details, name and position, information regarding the search mandate, recruitment preferences and feedback on the candidates we have proposed. In the case of confidential searches, we also treat information about the search mandate itself as confidential.

The legal basis is Article 6(1)(b) of the GDPR, where a natural person is our contractual partner, and otherwise Article 6(1)(f) of the GDPR (legitimate interest in the initiation and contractual performance of our services). We retain personal data relating to contact persons at a corporate client even after the contract has ended or if no contract has been concluded, for the purpose of re-establishing contact. We delete this data no later than 24 months after the last contact, or earlier should you inform us that you do not wish to use our services in future. Statutory retention obligations remain unaffected.

15. Special categories of personal data

Data within the meaning of Article 9(1) of the GDPR, such as health data, religious beliefs or political opinions, is generally not required for our services. Please do not send us such data unsolicited, not even in your CV, and do not enter it into AI-supported applications. Particularly during coaching following a break-up, such topics may come up; in such cases, we will not record them in writing unless it is necessary. Should such data actually become relevant in individual cases, we will obtain explicit consent in accordance with Article 9(2)(a) of the GDPR.

16. Use of AI systems (EU AI Act)

We use AI-powered tools and provide you with transparent information about this, regardless of whether there is a legal obligation to do so.

• Candidates: AI supports the identification of potential candidates and the organisation of our workflow (section 13.6). Transcription and documentation of interviews take place only with separate, prior and voluntary consent. Selection decisions are made exclusively by our consultants.
• Private clients: In coaching, we use AI-supported tools to assess current situations, prepare documents and, with consent, to document discussions. Personal consultation remains unaffected.
• Corporate clients and contacts: Briefings are only recorded and documented using AI with the consent of all participants.
• Data protection: Data processing is governed by the specifications and configurations of the respective services. According to the providers, user data is not used to train AI models.
• Information: You may enquire at any time as to which AI-supported tools have been used in connection with your data and for what purpose.

Regulation (EU) 2024/1689 (EU AI Act) may trigger different requirements depending on the actual product configuration and use. AI systems used in recruitment to assess or filter candidates may be classified as high-risk AI systems. The applications we use are intended for research, transcription, documentation and summarisation; they are not used for the automated assessment of suitability, selection, filtering or ranking of candidates. Should the actual use change, the processes and this privacy policy will be reviewed and amended accordingly.

17. Disclosure of data to third parties and service providers

We use your personal data exclusively for the purposes of our own services as outlined above. Internally, access is restricted to those persons involved in the respective task. This excludes service providers whom we require for the technical provision of individual services. The scope of data transfer is limited to the minimum extent permitted by law. Where required by law, such involvement takes place on the basis of a data processing agreement in accordance with Article 28 of the GDPR.

The following service providers, in particular, may be involved in the processing:

• ALL-INKL.COM – Neue Medien Münnich (hosting), Hauptstraße 68, 02742 Friedersdorf, Germany, server location: Germany
• Calendly, LLC (appointment booking), 115 E. Main Street, Suite A1B, Buford, GA 30518, USA
• Hedy AI LLC (transcription and AI-assisted conversation documentation), 5331 S Macadam Ave, Ste 258 PMB 1137, Portland, OR 97239-3871, USA
• Microsoft Ireland Operations Limited (Microsoft 365: email, calendar and document storage, Section 11), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
• Ezekia Ltd (candidate database, Section 13.5), United Kingdom; hereinafter Meyer Talent Acquisition GmbH (PARL ATS system), Grunowstraße 20a, 13187 Berlin, Germany
• Provider of the AI tools LinkedHelper and Claude (Anthropic) for candidate identification (Section 13.6) and LINC GmbH (LINC PROFILER) for digital HR diagnostics (Section 13.7), Grapengießerstr. 16, 21335 Lüneburg, Germany

We only pass on candidate documents to authorised corporate clients in accordance with Section 13.3. We provide corporate clients with no more than a written summary of the interview with a candidate, provided that the disclosure is necessary for the specific recruitment process and the relevant consent has been obtained. We do not pass on recordings or full transcripts to corporate clients.

In our executive search activities, we work with selected cooperation and network partners. These partners receive personal data only to the extent that this is necessary and permissible for their role in the specific mandate, in particular following your consent. In cases of joint controllership, we will provide the key terms of the agreement in accordance with Article 26 of the GDPR upon request. Tax and legal advisers, public authorities or courts will receive data to the extent that this is necessary to fulfil legal obligations or for the purposes of legal proceedings.

If we introduce a candidate to a specific company outside the European Union or the European Economic Area, it may be necessary to transfer the candidate’s personal data to the third country in question. Typically, this may include the candidate’s name, contact details, professional background, qualifications, CV details and a summary prepared specifically for the introduction; we only transfer the data necessary for the specific introduction. Such a transfer will only take place with your prior consent. The destination country may have a lower level of data protection than the EU. Prior to the transfer, we will provide information about the destination country and the intended transfer mechanism. The mechanisms under consideration include, in particular, an adequacy decision by the European Commission, standard contractual clauses pursuant to Article 46(2)(c) of the GDPR, or another safeguard permitted under Chapter V of the GDPR. This transfer relates exclusively to the candidate’s role.

18. Data transfers to third countries

The service providers referred to in section 17 generally process data in accordance with the specified configurations within the European Union or the European Economic Area. There are the following exceptions to this:

• Calendly, LLC: As it is based in the USA, there is a connection to the USA. According to its own statements, Calendly is certified under the EU-US Data Privacy Framework. The transfer is based on the EU Commission’s adequacy decision pursuant to Article 45 of the GDPR, supplemented by the EU Standard Contractual Clauses agreed with the provider pursuant to Article 46(2)(c) of the GDPR.
• Hedy AI LLC: As the provider is based in the US and certain technical services are provided there, there is a potential connection to a third country. Storage and AI analysis are configured to the European Union data region in accordance with the specified settings. Where a transfer to or access from a third country takes place, we base this on the EU Standard Contractual Clauses agreed with the provider in accordance with Article 46(2)(c) of the GDPR.
• Microsoft Ireland Operations Limited: The parent company, Microsoft Corporation, is based in the USA. Access from the USA cannot therefore be completely ruled out. Microsoft is certified under the EU-US Data Privacy Framework; the transfer is based on the EU Commission’s adequacy decision pursuant to Article 45 of the GDPR.
• Ezekia Ltd: The provider is based in the United Kingdom. An adequacy decision by the European Commission pursuant to Article 45 of the GDPR applies to the United Kingdom.
• AI tools (LinkedHelper, Claude): Where providers of these tools process data outside the European Union or the European Economic Area, the transfer is based on an adequacy decision by the European Commission (Article 45 of the GDPR) or on standard contractual clauses (Article 46(2)(c) of the GDPR).

Setting the data region to the European Union does not automatically preclude any access from third countries, for example by support staff or sub-contractors. The European Commission’s decision on the EU-US Data Privacy Framework applies only to organisations that have self-certified under it and are included on the official list. We regularly review the status of our US service providers. You can request a copy of the agreed safeguards from us at: nicole.kremer@zoom-consult.de.

19. Retention period and erasure

We store your personal data only for as long as is necessary for the respective processing purposes or where statutory retention periods apply. Statutory retention periods arise in particular from Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) (six, eight or ten years depending on the document). These obligations do not justify the blanket archiving of complete candidate or coaching files. In detail, the following periods generally apply:

• Server log files: maximum 30 days.
• CV upload form (copy on the web server): no more than one month.
• Email and telephone enquiries: until the enquiry has been dealt with, plus any statutory time limits.
• CV upload without a suitable mandate and without consent to be included in the candidate pool: deletion as soon as it is established that no current mandate is suitable, at the latest six months after receipt.
• Candidate data in the context of a mandate: for up to six months after the mandate has ended, unless you have consented to being included in the candidate pool.
• Candidate pool: until revoked, or for a maximum of three years after the last contact; before this period expires, we will ask you whether you wish to remain in the pool.
• Data of private clients from consultancy or coaching contracts: for the duration of the contract; thereafter, we retain the data for 12 months so that we can build on it should we work together again, and subsequently delete it, provided there are no statutory retention obligations to the contrary.
• Appointment bookings via Calendly: 12 months after the appointment, provided no contract has been concluded.
• Data relating to corporate clients and their contact persons: for the duration of the contract plus statutory retention periods; for contact person data, for a maximum of 24 months after the last contact.
• Data of decision-makers contacted: six months after the end of the assignment; immediate deletion in the event of an objection. Name, company and date of the objection remain on a block list.
• Record of consent and withdrawal: 3 years after the end of the relevant processing.
• Transcripts in the Hedy application: deleted by us once the summary has been generated; the provider does not delete them automatically. Summaries are stored alongside the relevant candidate or coaching data and are deleted immediately upon withdrawal of consent, provided there are no legal obligations to the contrary.
• Reach measurement (Koko Analytics): The daily audit value is deleted at midnight; only aggregated figures without any personal reference are stored permanently.

You may request the deletion of your data at any time by sending an informal email to nicole.kremer@zoom-consult.de. We will delete your data immediately, provided there are no statutory retention obligations or other legitimate grounds for further storage.

20. Is the provision of your data necessary?

You are under no legal or contractual obligation to provide us with personal data. The provision of such data is voluntary. However, without certain information, we may be unable to provide our service, or may only be able to do so to a limited extent:

• Private clients: For specific consultancy or coaching, we require contact details and the information necessary to carry out the service.
• Candidates: Without your professional background and contact details, we cannot assess your suitability for a specific assignment and cannot introduce you to a corporate client.
• CV upload: Without your name, email address and CV, we cannot process your documents. The position and brief description are optional and help us to categorise your application.
• Booking an appointment via Calendly: Without your name and email address, we cannot confirm the appointment. Details regarding the nature of your enquiry are optional and help us to prepare.
• Corporate clients and contact persons: We cannot process the order without the contact details of the relevant contact persons.

Consent to the recording and AI-assisted analysis of a conversation, to taking part in a digital HR assessment, or to being included in the candidate pool is under no circumstances a prerequisite. You will not suffer any disadvantages as a result. A legal obligation to provide such information exists only insofar as tax or commercial law regulations require this within the context of a business relationship.

21. Your rights as a data subject

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): You may request information about the personal data we process and a copy thereof.
• Rectification (Art. 16 GDPR): You may request the rectification of inaccurate data or the completion of incomplete data.
• Erasure (Art. 17 GDPR): You may request the erasure of your data, provided that there are no statutory retention obligations to the contrary.
• Restriction (Art. 18 GDPR): You may request the restriction of the processing of your data.
• Data portability (Art. 20 GDPR): You may receive your data in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR): You may object at any time to the processing of your data based on Art. 6(1)(f) GDPR (Section 22).
• Withdrawal of consent (Article 7(3) of the GDPR): You may withdraw your consent at any time with effect for the future, without this affecting the lawfulness of the processing carried out prior to such withdrawal.

To exercise your rights, please contact Nicole Kremer at nicole.kremer@zoom-consult.de. We generally respond to requests within one month. These rights also apply to stored AI outputs relating to you.

22. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR (Article 21(1) of the GDPR). In our case, this primarily concerns the processing of candidate data that we have collected through our own research, the data of decision-makers we have contacted (Section 12.4), and the contact details of contacts at corporate clients, which we retain for the purpose of contacting them again.

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or the processing serves to establish, exercise or defend legal claims. If your data is processed for direct marketing purposes, you may object at any time without giving reasons. We will then no longer use your data for this purpose (Article 21(2) and (3) of the GDPR). To object, simply send an informal message to nicole.kremer@zoom-consult.de.

23. Automated decision-making / profiling

No automated decision-making within the meaning of Article 22 of the GDPR takes place. The AI-supported tools we use assist with research, transcription, documentation and summarisation. They do not make any automated decisions regarding the suitability or selection of candidates. All decisions in the candidate and recruitment process are made by our consultants. Where tools match profiles against a requirements profile or where a digital personnel assessment generates a results profile, this may constitute profiling; this serves exclusively as a basis for human assessment, and you may object to it in accordance with Section 22. This assessment applies to the use described and will be reviewed should the product configuration or purpose change.

24. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR (Article 77 of the GDPR). The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA) Promenade 18, 91522 Ansbach Postal address: PO Box 1349, 91504 Ansbach Website: www.lda.bayern.de

Alternatively, you may also contact the supervisory authority in your place of residence or work.

25th amendment to this privacy policy

We reserve the right to update this privacy policy to bring it into line with changes in the legal landscape or changes to our services or data processing practices. You can find the latest version on this page.

Last updated: 11 November 2026