Privacy Policy
1. Data Protection at a Glance
General information
The following information provides an overview of what happens to your personal data when you visit our website, contact us or provide us with application or candidate information.
Personal data means any information relating to an identified or identifiable natural person.
Detailed information about data processing can be found in the following sections of this Privacy Policy.
Controller
The controller responsible for processing your personal data is:
Schauz HR Consulting GmbH
Geschwister-Scholl-Str. 128
20251 Hamburg
Germany
Telephone: +49 40 22 85 85 130
Email: privacy@schauz-hr.com
Website: https://schauz-hr.com
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
How do we collect your data?
Some of your data is collected when you voluntarily provide it to us. This may occur, for example, when you:
- contact us by email or telephone;
- send us application documents;
- provide us with a professional profile;
- participate in a recruitment or consulting process; or
- communicate with us as a client, prospective client or business partner.
Other data is collected automatically or, where required, after you have given your consent when you visit our website. This mainly comprises technical data, such as your browser type, operating system, IP address or the time at which you accessed the website.
As part of our executive search activities, we may also obtain professional information from publicly available professional sources.
What do we use your data for?
We process your data in particular:
- to provide our website securely and reliably;
- to respond to your enquiries;
- to initiate and perform contractual relationships;
- to provide executive search and recruitment services;
- to assess and contact candidates in relation to suitable search mandates;
- to manage our candidate pool;
- to advise clients and candidates;
- to comply with statutory obligations; and
- to establish, exercise or defend legal claims.
What rights do you have?
Subject to the applicable statutory requirements, you have the right to:
- obtain information about the personal data we hold about you;
- have inaccurate data corrected and incomplete data completed;
- request the erasure of your data;
- request restriction of the processing of your data;
- object to the processing of your data;
- withdraw any consent you have given;
- receive your data in a portable format; and
- lodge a complaint with a data protection supervisory authority.
To exercise your rights, you may contact us at any time at privacy@schauz-hr.com.
2. General Information on Data Processing
Data protection
We treat your personal data as confidential and process it in accordance with the applicable data protection legislation and this Privacy Policy.
We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, unlawful alteration or disclosure.
Please note that data transmitted via the internet, for example by email, may be subject to security vulnerabilities. Complete protection against access by third parties cannot be guaranteed.
Legal bases
We process personal data in particular on the following legal bases:
- Article 6(1)(a) GDPR: processing based on your consent;
- Article 6(1)(b) GDPR: processing necessary for the performance of a contract or in order to take steps at your request before entering into a contract;
- Article 6(1)(c) GDPR: processing necessary for compliance with a legal obligation;
- Article 6(1)(f) GDPR: processing necessary for the purposes of our legitimate interests or the legitimate interests of a third party.
Where special categories of personal data are processed, such processing is carried out only where a legal basis under Article 9(2) GDPR applies.
SSL or TLS encryption
For security reasons, this website uses SSL or TLS encryption.
You can recognise an encrypted connection by the “https://” prefix in your browser’s address bar and the padlock symbol displayed by your browser.
When encryption is enabled, data that you transmit to us cannot generally be read by third parties while in transit.
3. Data Collected When You Visit the Website
Hosting
This website is hosted by Host Europe GmbH.
When you visit our website, the hosting provider processes the personal data required to provide, operate and deliver the website securely. This may include IP addresses and technical access data.
The hosting service is used on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in providing a secure, reliable and technically functional website.
Where the hosting provider processes personal data on our behalf, a data processing agreement pursuant to Article 28 GDPR is in place.
Server log files
The hosting provider automatically collects and stores information in server log files that your browser transmits when you access the website. This information may include:
- IP address;
- browser type and browser version;
- language settings;
- operating system;
- referrer URL;
- hostname of the accessing device;
- date and time of the server request;
- pages and files accessed;
- volume of data transferred; and
- information indicating whether the request was successful.
Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically reliable provision of the website, the detection and prevention of attacks and the analysis of technical errors.
Server log files are generally erased after no more than 30 days unless longer storage is required to investigate a specific security incident.
Cookies and similar technologies
Our website only uses cookies or similar technologies where they are technically necessary to operate the website and provide functions expressly requested by you.
The storage of technically necessary information on your device, or access to such information, is based on Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed in this context, processing is based on Article 6(1)(f) GDPR.
Our legitimate interest lies in providing a secure and functional website.
If non-essential cookies, analytics, marketing or tracking technologies are used in the future, they will only be activated after you have given your prior consent. You may withdraw your consent at any time with effect for the future.
Locally hosted Google Fonts
This website uses Google Fonts to ensure a consistent presentation of fonts. The fonts used are hosted locally on our web server.
No connection to Google servers is therefore established when you visit our website, and no personal data is transmitted to Google in this context.
Anonymous website statistics
We may compile anonymous statistics about the use of our website on the basis of server log files.
Complete IP addresses are not used for this purpose, no user profiles are created and data is not combined across different websites. The anonymised statistical information cannot be attributed to individual visitors.
4. Contacting Us
Contact by email or telephone
If you contact us by email or telephone, we process your enquiry and the personal data contained in it in order to respond to your request and communicate with you.
Where your enquiry relates to an existing contract or concerns steps taken at your request before entering into a contract, processing is based on Article 6(1)(b) GDPR.
In all other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries addressed to us in an appropriate and efficient manner.
Where you have consented to further processing, that processing is based on Article 6(1)(a) GDPR.
The data transmitted will be erased once your enquiry has been fully dealt with and no statutory retention requirements or other legal grounds require further storage. General enquiries are usually erased no later than three months after the matter has been concluded.
Different retention periods apply to candidates, clients and contractual partners, as described below.
5. Recruitment and Candidate Data
Submission of application documents
You may submit application documents in relation to a specific position or as an unsolicited application.
We may process the following information in particular:
- name and contact details;
- postal address, where provided;
- CV and professional profile;
- education and qualifications;
- previous employers and professional positions;
- professional experience and areas of responsibility;
- career objectives and job preferences;
- geographical preferences and availability;
- salary expectations, where provided;
- communications and interview content;
- our notes and assessments; and
- feedback received during a recruitment process.
Purposes of processing
We process your data in particular:
- to handle your application or initial contact;
- to assess your qualifications and professional interests;
- to compare your profile with current or future search mandates;
- to include and manage your profile in our candidate pool;
- to contact you regarding suitable career opportunities;
- to prepare and conduct interviews;
- to discuss a potential introduction to a client;
- to support a selection and recruitment process; and
- to establish, exercise or defend legal claims.
Legal basis for unsolicited applications and the candidate pool
The processing of an unsolicited application, inclusion in our candidate pool and contacting you regarding potentially suitable search mandates are based on Article 6(1)(f) GDPR.
Our legitimate interest lies in identifying and contacting suitable candidates for current and future search mandates.
In carrying out the balancing of interests, we take into account that you have provided us with your documents on your own initiative with the recognisable intention of establishing professional contact.
Where a recruitment agreement exists between you and us, or where you request specific pre-contractual measures, processing may additionally be based on Article 6(1)(b) GDPR.
Disclosure to potential employers
We only disclose your non-anonymised application documents or other personal data to a potential employer after consulting you in advance and obtaining your express consent.
The legal basis for such disclosure is Article 6(1)(a) GDPR.
Before disclosing your data, we will generally inform you about the company concerned, the position to be filled and the intended scope of the data transfer.
Reference checks
We only contact referees or former employers if this has been agreed with you in advance and you have expressly consented.
Special categories of personal data
Please avoid providing us with special categories of personal data within the meaning of Article 9 GDPR. These include, in particular, information concerning:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic or biometric data used for unique identification;
- health;
- sex life or sexual orientation.
Where processing such information is exceptionally necessary, it will only be carried out on a permitted legal basis, in particular with your explicit consent pursuant to Article 9(2)(a) GDPR.
Voluntary provision of data
The provision of your data is voluntary. You are not legally or contractually required to provide us with application documents.
Without sufficient information about your professional profile, however, we will not be able to assess whether current or future search mandates match your qualifications and career objectives.
Retention period
For unsolicited applications, we retain your personal data for as long as necessary to assess and discuss suitable career opportunities, but no longer than three years from receipt of your documents.
If you applied for a specific position and no placement is made, the data relating to that process will generally be erased no later than seven months after the process has ended.
Data processed exclusively on the basis of consent will be erased when consent is withdrawn, unless another legal basis permits further retention.
Data will only be retained for longer periods where:
- statutory retention requirements apply;
- the data is required to establish, exercise or defend legal claims; or
- another legal basis permits further processing.
6. Direct Sourcing and Executive Search
Data from publicly available sources
As part of specific executive search mandates, we may process professional information about potential candidates that we have not obtained directly from the person concerned.
This information may originate from:
- publicly available professional networks;
- company websites;
- publicly available professional profiles;
- press releases and specialist publications;
- commercial and association registers;
- publicly available event and conference information; and
- referrals from our professional network.
We only process information that is relevant to professional contact and the assessment of potential suitability for a specific search mandate.
Purpose and legal basis
The data is processed for the purpose of:
- identifying suitable candidates;
- establishing professional contact;
- assessing potential suitability for a search mandate; and
- providing executive search services.
Processing is based on Article 6(1)(f) GDPR.
Our legitimate interests and the legitimate interests of our clients lie in identifying and approaching suitable professionals and executives for vacant positions.
When balancing the relevant interests, we take into account the professional context of the information, the public availability of the source, the nature of the position to be filled and the reasonable expectations of the person concerned.
We provide the information required under Article 14 GDPR no later than the time of our first communication with you or otherwise within the applicable statutory period.
Retention following a direct approach
If you are not interested in being contacted or in the position concerned, we generally erase the information stored for the purpose of approaching you as soon as it is no longer required.
If you object to further contact, we may retain the minimum information required in a suppression list so that we can comply with your objection in the future. This processing is based on Article 6(1)(f) GDPR.
If you wish to be included in our candidate pool, the retention periods for unsolicited applications apply.
7. Clients, Prospective Clients and Business Partners
We process personal data relating to contacts at clients, prospective clients, contracting parties, service providers and other business partners.
This information may include:
- name and position;
- business contact details;
- company and business unit;
- communication content;
- contractual, order and billing information; and
- meeting notes and project information.
The data is processed:
- to initiate and perform contracts;
- for communication and project delivery;
- to provide consulting and recruitment services;
- to invoice our services;
- to maintain existing business relationships;
- to comply with statutory obligations; and
- to establish, exercise or defend legal claims.
The legal bases are Article 6(1)(b), (c) and (f) GDPR. Where the data concerns a contact at a corporate client or business partner, our legitimate interest lies in performing and maintaining the relevant business relationship.
Contractual, accounting and billing documents are retained in accordance with statutory commercial and tax retention periods. Depending on the type of document, these periods may be up to ten years.
8. Recipients and Service Providers
Processors
We may use external service providers that process personal data on our behalf. These may include:
- hosting providers;
- email and communications providers;
- IT service and remote maintenance providers;
- cloud and backup providers;
- candidate and applicant management systems;
- office and collaboration software providers; and
- secure document and data carrier destruction services.
These service providers may only process personal data in accordance with our instructions and on the basis of a data processing agreement pursuant to Article 28 GDPR.
Other recipients
Where a legal basis applies, personal data may also be disclosed to:
- potential employers, exclusively after consulting the person concerned;
- clients in the context of an agreed recruitment process;
- lawyers, tax advisers and auditors;
- insurance companies, where necessary to handle a specific matter;
- courts and public authorities, where required by law; and
- other recipients where you have expressly consented to the disclosure.
Candidate data is not disclosed generally or without appropriate controls.
9. Transfers to Third Countries
Personal data is only transferred to countries outside the European Economic Area where the applicable legal requirements have been met.
Your application documents will only be transferred to a potential employer outside the European Economic Area following prior consultation with you and on a lawful basis.
Where service providers process data outside the European Economic Area, the transfer will be based in particular on:
- an adequacy decision adopted by the European Commission;
- appropriate safeguards pursuant to Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses; or
- a derogation under Article 49 GDPR, provided that the specific statutory requirements are met.
You may request information about the safeguards used by contacting privacy@schauz-hr.com.
10. Your Rights
Right of access
You have the right to request confirmation as to whether we process personal data concerning you and, where this is the case, to obtain access to that data.
Right to rectification
You have the right to request the correction of inaccurate data and the completion of incomplete data.
Right to erasure
Subject to the statutory requirements, you may request the erasure of your personal data.
The right to erasure does not apply in particular where statutory retention requirements apply or the data is required to establish, exercise or defend legal claims.
Right to restriction of processing
Subject to the statutory requirements, you may request restriction of the processing of your personal data.
Right to data portability
Where processing is carried out by automated means and is based on consent or a contract, you have the right, subject to the statutory requirements, to receive the data you provided in a structured, commonly used and machine-readable format.
Withdrawal of consent
You may withdraw any consent you have given at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
11. Right to Object Under Article 21 GDPR
Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims.
Where your personal data is processed for direct marketing purposes, you may object to such processing at any time without stating reasons. Following your objection, your data will no longer be processed for direct marketing purposes.
To exercise your right to object, simply send an informal message to privacy@schauz-hr.com.
12. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
In particular, you may contact the supervisory authority responsible for us:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22
20459 Hamburg
Germany
Telephone: +49 40 428 54-4040
Email: mailbox@datenschutz.hamburg.de
Website: https://datenschutz-hamburg.de
13. Automated Decision-Making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
Any technical or supporting comparison of professional qualifications with job requirements does not result in a solely automated selection decision. The final assessment is made by a person.
14. Updates to This Privacy Policy
We review this Privacy Policy regularly and update it when our processing activities, service providers or applicable legal requirements change.
Last updated: 1 September 2026